CVE-2026-68354
Received Received - Intake

Linux Kernel Firewire Net Fragmentation Reassembly Flaw

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment also closes the gap to the next or previous list entry. Those neighbor lookups currently assume that the current fragment always has a real next or previous fragment. At a list edge, the next or previous entry is the list head, not a struct fwnet_fragment_info. The gap checks also compare against the old edge of the current fragment instead of the edge after adding the new fragment. As a result, a fragment that bridges two existing ranges may leave two adjacent ranges unmerged, so fwnet_pd_is_complete() can miss a complete datagram. Check for the list head before looking up the neighboring fragment, and compare the neighbor against the new fragment's far edge when deciding whether to merge all three ranges. This issue was found by a static analysis checker and confirmed by manual source review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68354
EUVD
EUVD-2026-55455

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects the firewire network subsystem. It involves incorrect handling of fragmented network datagrams during reassembly. When a new fragment is added, the code fails to properly check if it bridges gaps between existing fragments, potentially leaving two adjacent ranges unmerged. This can cause the system to miss a complete datagram.

Detection Guidance

This vulnerability is specific to the Linux kernel's firewire network stack and may not have direct detection commands. Check kernel logs for firewire-related errors or crashes using 'dmesg | grep firewire' or 'journalctl -k | grep firewire'. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could lead to network data corruption or loss if fragmented datagrams are not properly reassembled. Systems relying on firewire networking may experience communication failures or incorrect data processing. However, the impact depends on whether firewire networking is actively used on the affected system.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the firewire network stack if not in use by blacklisting the module with 'echo blacklist firewire-net >> /etc/modprobe.d/disable-firewire.conf' and rebooting.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68354. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart