In the Linux kernel, the following vulnerability has been resolved: net: dsa: avoid suspicious RCU usage for synced VLAN-aware MAC addresses When using the felix driver (the only one which supports UC filtering and MC filtering) as a DSA master for a random other DSA switch, one can see the following stack trace when the downstream switch ports join a VLAN-aware bridge: ============================= WARNING: suspicious RCU usage ----------------------------- net/8021q/vlan_core.c:238 suspicious rcu_dereference_protected() usage! stack backtrace: Workqueue: dsa_ordered dsa_slave_switchdev_event_work Call trace: lockdep_rcu_suspicious+0x170/0x210 vlan_for_each+0x8c/0x188 dsa_slave_sync_uc+0x128/0x178 __hw_addr_sync_dev+0x138/0x158 dsa_slave_set_rx_mode+0x58/0x70 __dev_set_rx_mode+0x88/0xa8 dev_uc_add+0x74/0xa0 dsa_port_bridge_host_fdb_add+0xec/0x180 dsa_slave_switchdev_event_work+0x7c/0x1c8 process_one_work+0x290/0x568 What it's saying is that vlan_for_each() expects rtnl_lock() context and it's not getting it, when it's called from the DSA master's ndo_set_rx_mode(). The caller of that - dsa_slave_set_rx_mode() - is the slave DSA interface's dsa_port_bridge_host_fdb_add() which comes from the deferred dsa_slave_switchdev_event_work(). We went to great lengths to avoid the rtnl_lock() context in that call path in commit 0faf890fc519 ("net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work"), and calling rtnl_lock() is simply not an option due to the possibility of deadlocking when calling dsa_flush_workqueue() from the call paths that do hold rtnl_lock() - basically all of them. So, when the DSA master calls vlan_for_each() from its ndo_set_rx_mode(), the state of the 8021q driver on this device is really not protected from concurrent access by anything. Looking at net/8021q/, I don't think that vlan_info->vid_list was particularly designed with RCU traversal in mind, so introducing an RCU read-side form of vlan_for_each() - vlan_for_each_rcu() - won't be so easy, and it also wouldn't be exactly what we need anyway. In general I believe that the solution isn't in net/8021q/ anyway; vlan_for_each() is not cut out for this task. DSA doesn't need rtnl_lock() to be held per se - since it's not a netdev state change that we're blocking, but rather, just concurrent additions/removals to a VLAN list. We don't even need sleepable context - the callback of vlan_for_each() just schedules deferred work. The proposed escape is to remove the dependency on vlan_for_each() and to open-code a non-sleepable, rtnl-free alternative to that, based on copies of the VLAN list modified from .ndo_vlan_rx_add_vid() and .ndo_vlan_rx_kill_vid().

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: dsa: avoid suspicious RCU usage for synced VLAN-aware MAC addresses When using the felix driver (the     only one which supports UC filtering and MC filtering) as a DSA master for a random other DSA switch, one     can see the following stack trace when the downstream switch ports join a VLAN-aware bridge:
    ============================= WARNING: suspicious RCU usage -----------------------------     net/8021q/vlan_core.c:238 suspicious rcu_dereference_protected() usage! stack backtrace: Workqueue:
    dsa_ordered dsa_slave_switchdev_event_work Call trace: lockdep_rcu_suspicious+0x170/0x210     vlan_for_each+0x8c/0x188 dsa_slave_sync_uc+0x128/0x178 __hw_addr_sync_dev+0x138/0x158     dsa_slave_set_rx_mode+0x58/0x70 __dev_set_rx_mode+0x88/0xa8 dev_uc_add+0x74/0xa0     dsa_port_bridge_host_fdb_add+0xec/0x180 dsa_slave_switchdev_event_work+0x7c/0x1c8     process_one_work+0x290/0x568 What it's saying is that vlan_for_each() expects rtnl_lock() context and it's     not getting it, when it's called from the DSA master's ndo_set_rx_mode(). The caller of that -     dsa_slave_set_rx_mode() - is the slave DSA interface's dsa_port_bridge_host_fdb_add() which comes from the     deferred dsa_slave_switchdev_event_work(). We went to great lengths to avoid the rtnl_lock() context in     that call path in commit 0faf890fc519 (net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work),     and calling rtnl_lock() is simply not an option due to the possibility of deadlocking when calling     dsa_flush_workqueue() from the call paths that do hold rtnl_lock() - basically all of them. So, when the     DSA master calls vlan_for_each() from its ndo_set_rx_mode(), the state of the 8021q driver on this device     is really not protected from concurrent access by anything. Looking at net/8021q/, I don't think that     vlan_info->vid_list was particularly designed with RCU traversal in mind, so introducing an RCU read-side     form of vlan_for_each() - vlan_for_each_rcu() - won't be so easy, and it also wouldn't be exactly what we     need anyway. In general I believe that the solution isn't in net/8021q/ anyway; vlan_for_each() is not cut     out for this task. DSA doesn't need rtnl_lock() to be held per se - since it's not a netdev state change     that we're blocking, but rather, just concurrent additions/removals to a VLAN list. We don't even need     sleepable context - the callback of vlan_for_each() just schedules deferred work. The proposed escape is     to remove the dependency on vlan_for_each() and to open-code a non-sleepable, rtnl-free alternative to     that, based on copies of the VLAN list modified from .ndo_vlan_rx_add_vid() and .ndo_vlan_rx_kill_vid().
    (CVE-2023-54149)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
297194	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:0315-1)	Nessus	SuSE Local Security Checks	Local	high
296680	SUSE SLES15 / openSUSE 15 : Security update for the Linux Kernel (SUSE-SU-2026:0293-1)	Nessus	SuSE Local Security Checks	Local	high
296676	SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2026:0281-1)	Nessus	SuSE Local Security Checks	Local	high
296481	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0278-1)	Nessus	SuSE Local Security Checks	Local	high
280007	Linux Distros Unpatched Vulnerability : CVE-2023-54149	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2023-54149

high

Tenable Plugins

high

high

high

high

medium