net: hinic: avoid kernel hung in hinic_get_stats64()
In the Linux kernel, the following vulnerability has been resolved: net: hinic: avoid kernel hung in hinic_get_stats64() When using hinic device as a bond slave device, and reading device stats of master bond device, the kernel may hung. The kernel panic calltrace as follows: Kernel panic - not syncing: softlockup: hung tasks Call trace: native_queued_spin_lock_slowpath+0x1ec/0x31c dev_get_stats+0x60/0xcc dev_seq_printf_stats+0x40/0x120 dev_seq_show+0x1c/0x40 seq_read_iter+0x3c8/0x4dc seq_read+0xe0/0x130 proc_reg_read+0xa8/0xe0 vfs_read+0xb0/0x1d4 ksys_read+0x70/0xfc __arm64_sys_read+0x20/0x30 el0_svc_common+0x88/0x234 do_el0_svc+0x2c/0x90 el0_svc+0x1c/0x30 el0_sync_handler+0xa8/0xb0 el0_sync+0x148/0x180 And the calltrace of task that actually caused kernel hungs as follows: __switch_to+124 __schedule+548 schedule+72 schedule_timeout+348 __down_common+188 __down+24 down+104 hinic_get_stats64+44 [hinic] dev_get_stats+92 bond_get_stats+172 [bonding] dev_get_stats+92 dev_seq_printf_stats+60 dev_seq_show+24 seq_read_iter+964 seq_read+220 proc_reg_read+164 vfs_read+172 ksys_read+108 __arm64_sys_read+28 el0_svc_common+132 do_el0_svc+40 el0_svc+24 el0_sync_handler+164 el0_sync+324 When getting device stats from bond, kernel will call bond_get_stats(). It first holds the spinlock bond->stats_lock, and then call hinic_get_stats64() to collect hinic device's stats. However, hinic_get_stats64() calls `down(&nic_dev->mgmt_lock)` to protect its critical section, which may schedule current task out. And if system is under high pressure, the task cannot be woken up immediately, which eventually triggers kernel hung panic. Since previous patch has replaced hinic_dev.tx_stats/rx_stats with local variable in hinic_get_stats64(), there is nothing need to be protected by lock, so just removing down()/up() is ok.
- Published
- Jun 18, 2025
- Updated
- Jun 17, 2026
- EPSS
- 0.2% · 7th percentile
- CWE
- CWE-667
Sign in to follow · You’ll be notified if a followed record enters KEV, gets an exploit or is updated.
Report tools
Action score
22
Monitor
Low priority for now.
- CVSS
- 22 / 40 · 5.5 / 10
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.2%
Affected systems
| Vendor | Product | CPE |
|---|---|---|
| linux | linux kernel | cpe:2.3:o:linux:linux_kernel |
Affected versions
NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.
- linux linux kernel4.14 and later · before 5.10.137
- linux linux kernel5.11 and later · before 5.15.61
- linux linux kernel5.16 and later · before 5.18.18
- linux linux kernel5.19 and later · before 5.19.2
Versions reported by the vendor
Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.
Linux Linux
- 4.14affected
- edd384f682cc2981420628b769a1929db680f02f and later · before e74f3097a9c713ce855cda07713393bcc23a005daffected · git
- edd384f682cc2981420628b769a1929db680f02f and later · before 693f31dc91568e61047fd2980a8235e856cd9ce8affected · git
- edd384f682cc2981420628b769a1929db680f02f and later · before fced5bce712122654ec8a20356342698cce104d2affected · git
- edd384f682cc2981420628b769a1929db680f02f and later · before 3ba59bbe4f306bb6ee15753db0a40564c0eb7909affected · git
- edd384f682cc2981420628b769a1929db680f02f and later · before 98f9fcdee35add80505b6c73f72de5f750d5c03caffected · git
- before 4.14not affected · semver
- 5.10.137 and later · up to and including 5.10.*not affected · semver
- 5.15.61 and later · up to and including 5.15.*not affected · semver
- 5.18.18 and later · up to and including 5.18.*not affected · semver
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| Debian:12 | linux | before 6.0.2-1 | 6.0.2-1 |
Same product
linux: all recordsOther highest-scoring records for the same primary product.
- CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV89Now
- CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV85Now
- CVE-2016-5195Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect haKEV83Now
- CVE-2019-13272In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to creKEV77This week
- CVE-2013-6282The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addKEV77This week
- CVE-2013-2094The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows loKEV77This week
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Linux Linux | 3ba59bbe4f306bb6ee15753db0a40564c0eb7909 | Vendor (CNA) |
| Linux Linux | 693f31dc91568e61047fd2980a8235e856cd9ce8 | Vendor (CNA) |
| Linux Linux | 98f9fcdee35add80505b6c73f72de5f750d5c03c | Vendor (CNA) |
| Linux Linux | e74f3097a9c713ce855cda07713393bcc23a005d | Vendor (CNA) |
| Linux Linux | fced5bce712122654ec8a20356342698cce104d2 | Vendor (CNA) |
| debian:linux | 6.0.2-1 · Debian:12 | Package registry (OSV) |
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).
Patch and commit links
Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.
No commit or PR link among the references.
Credits
All researchersFinders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.
No credits in the CNA record.
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
No nightly-computed relations.
Chain candidates
An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.
—
Bug bounty scope
No known public program.
Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).
Technical details
Attack conditions
- Someone with local access to the system can trigger it.
- A low-privileged account is enough.
- No user action is required.
- No special conditions are required; it is repeatable.
If successful
- Confidentiality
- none
- Integrity
- none
- Availability
- high · the service can be disrupted
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- None
- Integrity impact
- None
- Availability impact
- High
Weakness class (CWE)
CWE-667 · Improper LockingCVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd-primary
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
Noroxi analysis
No Noroxi analysis for this record yet
We don't hand-write analysis for all 385,000+ vulnerabilities; that wouldn't be honest. For notable, high-impact vulnerabilities our team writes the mechanism, detection and remediation steps.
We use this product, ask for helpChange log
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
- git.kernel.org/stable/c/3ba59bbe4f306bb6ee15753db0a40564c0eb7909
- git.kernel.org/stable/c/693f31dc91568e61047fd2980a8235e856cd9ce8
- git.kernel.org/stable/c/98f9fcdee35add80505b6c73f72de5f750d5c03c
- git.kernel.org/stable/c/e74f3097a9c713ce855cda07713393bcc23a005d
- git.kernel.org/stable/c/fced5bce712122654ec8a20356342698cce104d2
Vendor advisories and official records. Exploit/PoC links are deliberately left out.