Cloudanix VulnDB

CVE-2026-98239

High · 8.1

CVSS

8.1

EPSS

0.5%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a network driver can let specially crafted incoming data corrupt memory and crash or take over affected computers.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability is a use-after-free write in lan743x_rx_process_buffer where ip_summed is written via a stale pointer to a freed fragment skb after lan743x_rx_trim_skb linearizes a multi-buffer packet on the final descriptor.

Why it matters to the business

Affected Linux systems using LAN743x hardware may experience kernel crashes or memory corruption that can lead to denial of service or, under high-complexity conditions, remote code execution on network-facing devices.

How an attack unfolds

An attacker sends packets that span multiple receive buffers (possible after a live MTU increase leaves old ring entries with smaller buffers), causing the checksum-success path to perform a write through the dangling fragment pointer.

How to fix it

Apply the upstream kernel fix that moves the ip_summed assignment to the surviving head skb; rebuild and deploy the updated kernel on systems using the lan743x driver.

How to confirm the fix worked

Confirm the patch by inspecting lan743x_rx_process_buffer for ip_summed assignment on the head skb, or execute the KUnit test that reproduces the two-buffer packet scenario and verifies absence of KASAN reports.

Typical attack path

  1. Increase MTU on the interface so existing RX ring entries retain smaller buffers
  2. Send network packets that require fragmentation across multiple descriptors
  3. Trigger the checksum offload success path in lan743x_rx_process_buffer
  4. Perform a write through the freed fragment skb pointer

How to detect it

Search kernel logs and KASAN reports for use-after-free writes mentioning lan743x_rx_process_buffer or lan743x_rx_trim_skb; correlate with network traffic spikes on the affected interface.

What your security team should do

  • Apply the kernel fix on all systems exposing LAN743x interfaces
  • Reboot or reload the driver after update to clear stale ring state
  • Enable KASAN or similar memory debugging on test systems to validate the fix
  • Monitor kernel crash reports for lan743x receive-path oopses

The record

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743x_rx_process_buffer() adds each non-first receive buffer to the head skb's frag_list. On the last descriptor, lan743x_rx_trim_skb() linearizes the head and frees the fragment skb metadata. The checksum-success path then writes ip_summed through the local skb pointer, which still points to the final fragment. This causes a use-after-free write when a packet spans more than one receive buffer. Set ip_summed on the surviving head skb instead. Multi-buffer receive can occur after a live MTU increase because existing ring entries keep their old buffer size until they are replenished. A KUnit test invoking lan743x_rx_process_buffer() with a two-buffer packet produced a one-byte KASAN use-after-free write before this change. The same test passed after the change. The driver object also builds with W=1. This was not tested on physical LAN743x hardware.

Affected packages

Ecosystem Package Introduced Fixed