CVE-2026-68354
High · 8.8CVSS
8.8
EPSS
0.3%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A bug in how Linux handles pieces of network messages on FireWire connections can cause complete messages to be treated as incomplete, leading to lost data or crashes.
- Exploitation
- Adjacent Network
- Attacker needs
- None
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Incorrect neighbor lookups and edge comparisons in fwnet_frag_new() prevent merging of adjacent fragment ranges at list boundaries, so fwnet_pd_is_complete() fails to recognize fully reassembled datagrams.
Why it matters to the business
FireWire networking in affected Linux kernels may drop valid packets or leave partial datagrams unprocessed, causing unreliable communication or application-level failures on systems using this subsystem.
How an attack unfolds
An attacker on the same FireWire bus sends a sequence of fragmented datagrams crafted so that a bridging fragment reaches a list edge; the flawed gap checks leave ranges unmerged and a complete datagram is never recognized.
How to fix it
Apply the upstream fix that adds list-head checks before neighbor dereference and compares against the updated fragment edge; rebuild and deploy the corrected kernel.
How to confirm the fix worked
Confirm the patched source contains the list-head guard and new-edge comparison in fwnet_frag_new(); test reassembly with synthetic adjacent fragments that close gaps at list boundaries.
Typical attack path
- Gain adjacent access to the FireWire bus
- Transmit fragmented datagrams that straddle existing fragment list entries
- Trigger the edge-case neighbor lookup and incorrect far-edge comparison
- Cause fwnet_pd_is_complete() to return false for a finished datagram
- Induce packet loss or force fallback/error handling in upper layers
How to detect it
Review kernel logs for repeated firewire net reassembly warnings or incomplete datagram timeouts; correlate with FireWire traffic captures showing fragmented frames that should have merged.
What your security team should do
- Prioritize kernel update on any system exposing FireWire interfaces
- Disable the firewire-net module if the interface is unused
- Monitor EPSS and KEV status for changes in exploit availability
The record
In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment also closes the gap to the next or previous list entry. Those neighbor lookups currently assume that the current fragment always has a real next or previous fragment. At a list edge, the next or previous entry is the list head, not a struct fwnet_fragment_info. The gap checks also compare against the old edge of the current fragment instead of the edge after adding the new fragment. As a result, a fragment that bridges two existing ranges may leave two adjacent ranges unmerged, so fwnet_pd_is_complete() can miss a complete datagram. Check for the list head before looking up the neighboring fragment, and compare the neighbor against the new fragment's far edge when deciding whether to merge all three ranges. This issue was found by a static analysis checker and confirmed by manual source review.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|