{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68354", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.385Z", "datePublished": "2026-08-10T12:03:31.348Z", "dateUpdated": "2026-08-19T16:34:00.740Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:34:00.740Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: net: Fix fragmented datagram reassembly\n\nfwnet_frag_new() keeps a sorted list of received fragments for a partial\ndatagram. When a new fragment is adjacent to an existing fragment, the\ncode checks whether the new fragment also closes the gap to the next or\nprevious list entry.\n\nThose neighbor lookups currently assume that the current fragment always\nhas a real next or previous fragment. At a list edge, the next or\nprevious entry is the list head, not a struct fwnet_fragment_info.\n\nThe gap checks also compare against the old edge of the current fragment\ninstead of the edge after adding the new fragment. As a result, a\nfragment that bridges two existing ranges may leave two adjacent ranges\nunmerged, so fwnet_pd_is_complete() can miss a complete datagram.\n\nCheck for the list head before looking up the neighboring fragment, and\ncompare the neighbor against the new fragment's far edge when deciding\nwhether to merge all three ranges.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerable reassembly code processes IP-over-1394 (RFC 2734) fragments arriving from another node on the shared IEEE 1394 bus via fwnet_receive_packet/fwnet_receive_broadcast -> fwnet_incoming_packet -> fwnet_pd_update -> fwnet_frag_new, matching this CNA's Adjacent shared-physical-segment model for FireWire (CVE-2023-53432, CVE-2024-50113).\nAC:L - The attacker fully controls fg_off, dg_size and fragment ordering (12-bit fields, 0-4095) and can create unlimited fresh partial datagrams, so they can sweep every boundary offset against the aliased pd->skb bits and groom skb allocation until the type-confused compare matches; once it does, the list-head corruption and misaligned kfree are deterministic, with no attacker-uncontrollable race involved.\nPR:N - fwnet_receive_packet accepts TCODE_WRITE_BLOCK_REQUEST payloads from any bus peer and fwnet_receive_broadcast processes GASP packets automatically, with no credentials, capability check, or authentication anywhere on the path to fwnet_frag_new.\nUI:N - Fragment reassembly runs entirely in FireWire IRQ/softirq context once the firewire-net interface is up; the attacker's own node supplies the fragments and no victim action such as opening, mounting, or clicking is needed.\nS:U - The corruption is confined to kernel slab objects (fwnet_partial_datagram, sk_buff) under the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - list_entry() on the list head reads the low 32 bits of pd->skb as fragment metadata (a kernel-pointer disclosure primitive), the missed merge lets fwnet_pd_is_complete() hand up an skb whose unwritten gaps contain uninitialized heap data, and the resulting slab freelist corruption from kfree() of an interior pointer yields overlapping objects usable for arbitrary kernel memory read.\nI:H - The prepend branch performs fi2->len += fi->len + len directly into bits 16-31 of pd->skb, giving a partially attacker-influenced write to a kernel pointer that is later passed to dev_kfree_skb_any() (arbitrary free), while the append branch's kfree() of pd+16 corrupts the SLUB freelist into attacker-groomable overlapping allocations - both classic control-flow-hijack primitives.\nA:H - list_del() on the list head leaves pd->fi_list poisoned, and the immediately following fwnet_pd_is_complete() dereferences LIST_POISON1 in interrupt context while holding dev->lock with IRQs disabled, oopsing or hanging the machine; the misaligned kfree() also trips slab debug BUGs, and a bus peer can repeat the packet flood to crash the system at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/firewire/net.c" ], "versions": [ { "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb", "lessThan": "1aaf16031d65ccd4576451a79f7dabbec994c111", "status": "affected", "versionType": "git" }, { "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb", "lessThan": "0a219b2a01b4fe93706717e3bcacf7f62967b26f", "status": "affected", "versionType": "git" }, { "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb", "lessThan": "268cea3800eda5fa3ee04a49ee2973b8766a8df3", "status": "affected", "versionType": "git" }, { "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb", "lessThan": "b7d633c7c92321be98724b1d365e8ce507f2f349", "status": "affected", "versionType": "git" }, { "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb", "lessThan": "22e05b8ddbcf7d22c7f1598786e86635547e554d", "status": "affected", "versionType": "git" }, { "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb", "lessThan": "0177e578d7a885037b0fb82286c12e9d0360cc10", "status": "affected", "versionType": "git" }, { "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb", "lessThan": "2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999", "status": "affected", "versionType": "git" }, { "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb", "lessThan": "d52a13adbb8ccbab99cd3bad36804e87d8b5c052", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/firewire/net.c" ], "versions": [ { "version": "2.6.31", "status": "affected" }, { "version": "0", "lessThan": "2.6.31", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.10.265" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.6.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.12.101" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.18.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1aaf16031d65ccd4576451a79f7dabbec994c111" }, { "url": "https://git.kernel.org/stable/c/0a219b2a01b4fe93706717e3bcacf7f62967b26f" }, { "url": "https://git.kernel.org/stable/c/268cea3800eda5fa3ee04a49ee2973b8766a8df3" }, { "url": "https://git.kernel.org/stable/c/b7d633c7c92321be98724b1d365e8ce507f2f349" }, { "url": "https://git.kernel.org/stable/c/22e05b8ddbcf7d22c7f1598786e86635547e554d" }, { "url": "https://git.kernel.org/stable/c/0177e578d7a885037b0fb82286c12e9d0360cc10" }, { "url": "https://git.kernel.org/stable/c/2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999" }, { "url": "https://git.kernel.org/stable/c/d52a13adbb8ccbab99cd3bad36804e87d8b5c052" } ], "title": "firewire: net: Fix fragmented datagram reassembly", "x_generator": { "engine": "bippy-1.2.0" } } } }