All vulnerabilities
CVE-2026-98239

Linux: net: lan743x: fix RX checksum use-after-free

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0e52886c4324c9897c2c62f92be3dc8316cee67eAlso 6fe5c3a2503983abb431d93faeadfc7f5e6a7e33, 5c216bfa9fb7b36804485e67975e9c98055b31ef and 1 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 0e52886c4324c9897c2c62f92be3dc8316cee67eLinuxCVE List
  • 6fe5c3a2503983abb431d93faeadfc7f5e6a7e33LinuxCVE List
  • 5c216bfa9fb7b36804485e67975e9c98055b31efLinuxCVE List
  • 161a403c8625e152de03d1da22bbf9cda6dc9f9fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: lan743x: fix RX checksum use-after-free

lan743x_rx_process_buffer() adds each non-first receive buffer to the head skb's frag_list. On the last descriptor, lan743x_rx_trim_skb() linearizes the head and frees the fragment skb metadata.

The checksum-success path then writes ip_summed through the local skb pointer, which still points to the final fragment. This causes a use-after-free write when a packet spans more than one receive buffer.

Set ip_summed on the surviving head skb instead. Multi-buffer receive can occur after a live MTU increase because existing ring entries keep their old buffer size until they are replenished.

A KUnit test invoking lan743x_rx_process_buffer() with a two-buffer packet produced a one-byte KASAN use-after-free write before this change. The same test passed after the change. The driver object also builds with W=1. This was not tested on physical LAN743x hardware.

Text from CVE List

Affected versions 14

  • Linuxaffected: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a before 0e52886c4324c9897c2c62f92be3dc8316cee67eCVE List
  • Linuxaffected: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a before a58024835c704419bb46d2a34e5223f65605f958CVE List
  • Linuxaffected: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a before 6fe5c3a2503983abb431d93faeadfc7f5e6a7e33CVE List
  • Linuxaffected: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a before 5c216bfa9fb7b36804485e67975e9c98055b31efCVE List
  • Linuxaffected: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a before 161a403c8625e152de03d1da22bbf9cda6dc9f9fCVE List
  • Linuxaffected: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a before a9ce4053dc945c5372dedba5017ee675b30dc0c5CVE List
  • Linuxaffected: 6.1CVE List
  • Linuxunaffected: all versions before 6.1CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6