The Linux kernel txgbe driver includes a flaw where the phylink_disconnect_phy function is invoked during module removal without first acquiring the RTNL lock, resulting in an RTNL assertion warning in drivers/net/phy/phylink.c. This indicates that kernel synchronization requirements were violated, a weakness identified as CWE-414. The warning appears when attempting to unload the txgbe module on systems running a kernel that has not yet applied the corresponding patch.

All Linux kernel releases that ship the txgbe driver for copper network interface cards with an external PHY and that have not included the commit replacing phylink_disconnect_phy with a properly locked call are affected. This includes every kernel version that contains the txgbe module before the commit 0305e7... was merged.

EPSS data is not available and the CVE is not listed in the CISA KEV catalog. The issue only manifests when a privileged user unloads the txgbe module, producing a kernel warning; there is no evidence of a system crash or remote exploitation. Consequently, the risk is low to moderate, confined to local environments where module removal is permitted. Monitoring system logs for the RTNL: assertion failed message can provide early detection.