- 8.1HighCVSS base score
- 0.43%Exploitation in 30 daysEPSS · top 62% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743x_rx_process_buffer() adds each non-first receive buffer to the head skb's frag_list. On the last descriptor, lan743x_rx_trim_skb() linearizes the head and frees the fragment skb metadata. The checksum-success path then writes ip_summed through the local skb pointer, which still points to the final fragment. This causes a use-after-free write when a packet spans more than one receive buffer. Set ip_summed on the surviving head skb instead. Multi-buffer receive can occur after a live MTU increase because existing ring entries keep their old buffer size until they are replenished. A KUnit test invoking lan743x_rx_process_buffer() with a two-buffer packet produced a one-byte KASAN use-after-free write before this change. The same test passed after the change. The driver object also builds with W=1. This was not tested on physical LAN743x hardware.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 13 days later
· 13 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.43% · top 62% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Affected products
- affected cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a – < 0e52886c4324c9897c2c62f92be3dc8316cee67e
- affected cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a – < a58024835c704419bb46d2a34e5223f65605f958
- affected cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a – < 6fe5c3a2503983abb431d93faeadfc7f5e6a7e33
- affected cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a – < 5c216bfa9fb7b36804485e67975e9c98055b31ef
- affected cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a – < 161a403c8625e152de03d1da22bbf9cda6dc9f9f
- affected cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a – < a9ce4053dc945c5372dedba5017ee675b30dc0c5
- affected 6.1
- unaffected < 6.1
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.54 – ≤ 6.18.*
- unaffected 7.2.8 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/0e52886c4324c9897c2c62f92be3dc8316cee67e (opens in a new tab)
- https://git.kernel.org/stable/c/a58024835c704419bb46d2a34e5223f65605f958 (opens in a new tab)
- https://git.kernel.org/stable/c/6fe5c3a2503983abb431d93faeadfc7f5e6a7e33 (opens in a new tab)
- https://git.kernel.org/stable/c/5c216bfa9fb7b36804485e67975e9c98055b31ef (opens in a new tab)
- https://git.kernel.org/stable/c/161a403c8625e152de03d1da22bbf9cda6dc9f9f (opens in a new tab)
- https://git.kernel.org/stable/c/a9ce4053dc945c5372dedba5017ee675b30dc0c5 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-93167 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98239)Record last updated .