{"id":"DEBIAN-CVE-2025-23163","details":"In the Linux kernel, the following vulnerability has been resolved:  net: vlan: don't propagate flags on open  With the device instance lock, there is now a possibility of a deadlock:  [    1.211455] ============================================ [    1.211571] WARNING: possible recursive locking detected [    1.211687] 6.14.0-rc5-01215-g032756b4ca7a-dirty #5 Not tainted [    1.211823] -------------------------------------------- [    1.211936] ip/184 is trying to acquire lock: [    1.212032] ffff8881024a4c30 (&dev-\u003elock){+.+.}-{4:4}, at: dev_set_allmulti+0x4e/0xb0 [    1.212207] [    1.212207] but task is already holding lock: [    1.212332] ffff8881024a4c30 (&dev-\u003elock){+.+.}-{4:4}, at: dev_open+0x50/0xb0 [    1.212487] [    1.212487] other info that might help us debug this: [    1.212626]  Possible unsafe locking scenario: [    1.212626] [    1.212751]        CPU0 [    1.212815]        ---- [    1.212871]   lock(&dev-\u003elock); [    1.212944]   lock(&dev-\u003elock); [    1.213016] [    1.213016]  *** DEADLOCK *** [    1.213016] [    1.213143]  May be due to missing lock nesting notation [    1.213143] [    1.213294] 3 locks held by ip/184: [    1.213371]  #0: ffffffff838b53e0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock+0x1b/0xa0 [    1.213543]  #1: ffffffff84e5fc70 (&net-\u003ertnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock+0x37/0xa0 [    1.213727]  #2: ffff8881024a4c30 (&dev-\u003elock){+.+.}-{4:4}, at: dev_open+0x50/0xb0 [    1.213895] [    1.213895] stack backtrace: [    1.213991] CPU: 0 UID: 0 PID: 184 Comm: ip Not tainted 6.14.0-rc5-01215-g032756b4ca7a-dirty #5 [    1.213993] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 [    1.213994] Call Trace: [    1.213995]  \u003cTASK\u003e [    1.213996]  dump_stack_lvl+0x8e/0xd0 [    1.214000]  print_deadlock_bug+0x28b/0x2a0 [    1.214020]  lock_acquire+0xea/0x2a0 [    1.214027]  __mutex_lock+0xbf/0xd40 [    1.214038]  dev_set_allmulti+0x4e/0xb0 # real_dev-\u003eflags & IFF_ALLMULTI [    1.214040]  vlan_dev_open+0xa5/0x170 # ndo_open on vlandev [    1.214042]  __dev_open+0x145/0x270 [    1.214046]  __dev_change_flags+0xb0/0x1e0 [    1.214051]  netif_change_flags+0x22/0x60 # IFF_UP vlandev [    1.214053]  dev_change_flags+0x61/0xb0 # for each device in group from dev-\u003evlan_info [    1.214055]  vlan_device_event+0x766/0x7c0 # on netdevsim0 [    1.214058]  notifier_call_chain+0x78/0x120 [    1.214062]  netif_open+0x6d/0x90 [    1.214064]  dev_open+0x5b/0xb0 # locks netdevsim0 [    1.214066]  bond_enslave+0x64c/0x1230 [    1.214075]  do_set_master+0x175/0x1e0 # on netdevsim0 [    1.214077]  do_setlink+0x516/0x13b0 [    1.214094]  rtnl_newlink+0xaba/0xb80 [    1.214132]  rtnetlink_rcv_msg+0x440/0x490 [    1.214144]  netlink_rcv_skb+0xeb/0x120 [    1.214150]  netlink_unicast+0x1f9/0x320 [    1.214153]  netlink_sendmsg+0x346/0x3f0 [    1.214157]  __sock_sendmsg+0x86/0xb0 [    1.214160]  ____sys_sendmsg+0x1c8/0x220 [    1.214164]  ___sys_sendmsg+0x28f/0x2d0 [    1.214179]  __x64_sys_sendmsg+0xef/0x140 [    1.214184]  do_syscall_64+0xec/0x1d0 [    1.214190]  entry_SYSCALL_64_after_hwframe+0x77/0x7f [    1.214191] RIP: 0033:0x7f2d1b4a7e56  Device setup:       netdevsim0 (down)      ^        ^   bond        netdevsim1.100@netdevsim1 allmulticast=on (down)  When we enslave the lower device (netdevsim0) which has a vlan, we propagate vlan's allmuti/promisc flags during ndo_open. This causes (re)locking on of the real_dev.  Propagate allmulti/promisc on flags change, not on the open. There is a slight semantics change that vlans that are down now propagate the flags, but this seems unlikely to result in the real issues.  Reproducer:    echo 0 1 \u003e /sys/bus/netdevsim/new_device    dev_path=$(ls -d /sys/bus/netdevsim/devices/netdevsim0/net/*)   dev=$(echo $dev_path | rev | cut -d/ -f1 | rev)    ip link set dev $dev name netdevsim0   ip link set dev netdevsim0 up    ip link add link netdevsim0 name netdevsim0.100 type vlan id 100   ip link set dev netdevsim0.100 allm ---truncated---","modified":"2026-09-01T16:06:11.282351523Z","published":"2025-05-01T13:15:52.273Z","upstream":["CVE-2025-23163"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-23163"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.135-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-23163.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-23163.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-23163.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}