CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module
In the Linux kernel, the following vulnerability has been resolved:
net: txgbe: fix RTNL assertion warning when remove module
For the copper NIC with external PHY, the driver called phylinkconnectphy() during probe and phylinkdisconnectphy() during remove. It caused an RTNL assertion warning in phylinkdisconnectphy() upon module remove.
To fix this, add rtnllock() and rtnlunlock() around the phylinkdisconnectphy() in remove function.
------------[ cut here ]------------ RTNL: assertion failed at drivers/net/phy/phylink.c (2351) WARNING: drivers/net/phy/phylink.c:2351 at phylinkdisconnectphy+0xd8/0xf0 [phylink], CPU#0: rmmod/4464 Modules linked in: ... CPU: 0 UID: 0 PID: 4464 Comm: rmmod Kdump: loaded Not tainted 7.0.0-rc4+ Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 RIP: 0010:phylinkdisconnectphy+0xe4/0xf0 [phylink] Code: 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 f6 31 ff e9 3a 38 8f e7 48 8d 3d 48 87 e2 ff ba 2f 09 00 00 48 c7 c6 c1 22 24 c0 <67> 48 0f b9 3a e9 34 ff ff ff 66 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffce7288363ac0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff89654b2a1a00 RCX: 0000000000000000 RDX: 000000000000092f RSI: ffffffffc02422c1 RDI: ffffffffc0239020 RBP: ffffce7288363ae8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8964c4022000 R13: ffff89654fce3028 R14: ffff89654ebb4000 R15: ffffffffc0226348 FS: 0000795e80d93780(0000) GS:ffff896c52857000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005b528b592000 CR3: 0000000170d0f000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: <TASK> txgberemovephy+0xbb/0xd0 [txgbe] txgberemove+0x4c/0xb0 [txgbe] pcideviceremove+0x41/0xb0 deviceremove+0x43/0x80 devicereleasedriverinternal+0x206/0x270 driverdetach+0x4a/0xa0 busremovedriver+0x83/0x120 driverunregister+0x2f/0x60 pciunregisterdriver+0x40/0x90 txgbedriverexit+0x10/0x850 [txgbe] dosysdeletemodule.isra.0+0x1c3/0x2f0 x64sysdeletemodule+0x12/0x20 x64syscall+0x20c3/0x2390 dosyscall64+0x11c/0x1500 ? srsoaliasreturnthunk+0x5/0xfbef5 ? dosyscall64+0x15a/0x1500 ? srsoaliasreturnthunk+0x5/0xfbef5 ? dofault+0x312/0x580 ? srsoaliasreturnthunk+0x5/0xfbef5 ? handlemmfault+0x9d5/0x1040 ? srsoaliasreturnthunk+0x5/0xfbef5 ? countmemcgevents+0x101/0x1d0 ? srsoaliasreturnthunk+0x5/0xfbef5 ? handlemmfault+0x1e8/0x2f0 ? srsoaliasreturnthunk+0x5/0xfbef5 ? douseraddrfault+0x2f8/0x820 ? srsoaliasreturnthunk+0x5/0xfbef5 ? irqentryexit+0xb2/0x600 ? srsoaliasreturnthunk+0x5/0xfbef5 ? excpagefault+0x92/0x1c0 entrySYSCALL64afterhwframe+0x76/0x7e
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Patch the kernel code so that rtnl_lock() and rtnl_unlock() are added around the RTNL assertion warning in phylink_disconnect_phy() (drivers/net/phy/phylink.c, line 2351), preventing the RTNL assertion warning during module removal (e.g., delete_module/remove path).
Linux kernel networking stack (phylink_disconnect_phy / phylink.c) RTNL locking around phylink_disconnect_phy() = add rtnl_lock() and rtnl_unlock() around the warning location (drivers/net/phy/phylink.c:2351 in __do_sys_delete_module / __handle_mm_fault path)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46287?
The severity of CVE-2026-46287 is rated as 8.
How do I fix CVE-2026-46287?
To fix CVE-2026-46287, update to the latest version of the Intel txgbe driver that addresses the RTNL assertion warning.
What type of systems are affected by CVE-2026-46287?
CVE-2026-46287 affects systems using the Intel txgbe driver in the Linux kernel, particularly those with copper NIC and external PHY.
What is the nature of the issue described in CVE-2026-46287?
The issue in CVE-2026-46287 involves an RTNL assertion warning triggered by the driver during module removal.
When was CVE-2026-46287 published?
CVE-2026-46287 was published on June 8, 2026.