A lock ordering issue in the Linux kernel causes a classic AB-BA deadlock when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled. The deadlock occurs because LED_TRIGGER_PHY registers LED triggers during PHY probe while holding the RTNL lock, while LEDS_TRIGGER_NETDEV subsequently attempts to register an LED trigger while holding the triggers_list_lock. This results in a circular wait that can cause the system or network stack to become unresponsive, leading to degraded functionality or service interruptions. The weakness is classified as CWE-833, a deadlock and circular waiting scenario.

All Linux kernel builds that include the legacy phy led trigger registration path are affected. The impact covers any system that enables both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY, regardless of distribution or hardware, as the vendor list reflects only the Linux kernel itself. No specific kernel version is specified, but the problem has been fixed in later commits; users should check for updates that incorporate the fix.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the system to have both LED triggers enabled and the deadlock conditions to be triggered during device initialization. Attackers would need local system access or the ability to influence driver probe sequences; remote exploitation is unlikely. The primary risk is a system lock-up rather than data compromise.