{"id":21332,"date":"2026-09-12T04:31:03","date_gmt":"2026-09-11T20:31:03","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80999"},"modified":"2026-09-12T04:31:03","modified_gmt":"2026-09-11T20:31:03","slug":"cve-2026-80999","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80999","title":{"rendered":"CVE-2026-80999 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: realtek: us"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO<\/p>\n<p>rtl83xx_reset_assert() and rtl83xx_reset_deassert() are only called from<br \/>\nthe probe path, which may sleep and is not timing-critical.  When the<br \/>\nreset GPIO is provided by a sleeping controller such as an I2C I\/O<br \/>\nexpander, gpiod_set_value() warns:<\/p>\n<p>  WARNING: drivers\/gpio\/gpiolib.c:4030 at gpiod_set_value+0x44\/0x80, CPU#1: kworker\/u16:4\/61<br \/>\n  Hardware name: B&amp;O MAP CA33 Rev f (UNKNOWN) (DT)<br \/>\n  Workqueue: events_unbound deferred_probe_work_func<br \/>\n  pc : gpiod_set_value+0x44\/0x80<br \/>\n  lr : rtl83xx_probe+0x1d8\/0x3a0<br \/>\n  Call trace:<br \/>\n   gpiod_set_value+0x44\/0x80 (P)<br \/>\n   rtl83xx_probe+0x1d8\/0x3a0<br \/>\n   realtek_mdio_probe+0x24\/0xa0<br \/>\n   mdio_probe+0x38\/0x78<br \/>\n   really_probe+0xc4\/0x3e0<br \/>\n   __driver_probe_device+0x15c\/0x1b8<br \/>\n   driver_probe_device+0xb4\/0x120<br \/>\n   __device_attach_driver+0xb8\/0x1a0<br \/>\n   bus_for_each_drv+0x88\/0xf0<br \/>\n   __device_attach+0xa0\/0x1d8<br \/>\n   device_initial_probe+0x54\/0x68<br \/>\n   bus_probe_device+0x38\/0xa0<br \/>\n   deferred_probe_work_func+0xb8\/0x120<br \/>\n   process_one_work+0x184\/0x4e8<br \/>\n   worker_thread+0x188\/0x308<br \/>\n   kthread+0x130\/0x150<br \/>\n   ret_from_fork+0x10\/0x20<\/p>\n<p>Switch both helpers to gpiod_set_value_cansleep() so such a reset GPIO can<br \/>\nbe used without triggering the warning.<\/p>\n<p>The reset GPIO has been driven with the non-sleeping gpiod_set_value()<br \/>\nsince the driver was added in v4.19.  The call has since been refactored<br \/>\nacross several files &#8211; from realtek-smi.c \/ realtek-mdio.c into the common<br \/>\nrtl83xx.c module and then into the rtl83xx_reset_assert() and<br \/>\nrtl83xx_reset_deassert() helpers (both in v6.9).  This patch therefore<br \/>\napplies as-is only to kernels that carry those helpers (v6.9+); older<br \/>\nstable kernels need the same gpiod_set_value_cansleep() conversion at the<br \/>\ncorresponding open-coded call sites.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO<\/p>\n<p>rtl83xx_reset_assert() and rtl83xx_reset_deassert() are only called<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21332","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}