CVE-2026-72393

Received Received - Intake

Use-After-Free in Linux Kernel fbnic Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in fbnic_tx_lso.isra.0+0x668/0x8e0 Read of size 4 at addr ff110000262edd98 by task swapper/5/0 Call Trace: fbnic_tx_lso.isra.0+0x668/0x8e0 fbnic_xmit_frame+0x622/0xba0 dev_hard_start_xmit+0xf4/0x620 Allocated by task 8653: __alloc_skb+0x11e/0x5f0 alloc_skb_with_frags+0xcc/0x6c0 sock_alloc_send_pskb+0x327/0x3f0 __ip_append_data+0x188b/0x47a0 ip_make_skb+0x24a/0x300 udp_sendmsg+0x14d2/0x21e0 Freed by task 0: kfree+0x123/0x5a0 pskb_expand_head+0x36c/0xfa0 fbnic_tx_lso.isra.0+0x500/0x8e0 fbnic_xmit_frame+0x622/0xba0 dev_hard_start_xmit+0xf4/0x620 sch_direct_xmit+0x25b/0x1100 The buggy address belongs to the object at ff110000262edc40 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 344 bytes inside of freed 640-byte region [ff110000262edc40, ff110000262ede

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72393

EUVD

EUVD-2026-59292

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free bug in the fbnic network driver. The issue occurs when the driver caches a pointer to shared info in an skb before calling skb_cow_head(), which may reallocate the skb. This leads to accessing freed memory, causing a slab-use-after-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's fbnic driver and involves a use-after-free issue in the tx_lso function. Detection requires kernel logging and analysis. Check kernel logs for KASAN errors or slab-use-after-free messages related to fbnic_tx_lso. Commands like dmesg | grep -i kasan or journalctl -k | grep -i slab-use-after-free may help identify affected systems.

Impact Analysis

This vulnerability could cause system crashes, kernel panics, or arbitrary code execution on affected systems. It may lead to denial-of-service conditions or potential privilege escalation if exploited.

Compliance Impact

This vulnerability is a use-after-free bug in the Linux kernel's fbnic network driver that could lead to memory corruption or crashes. It does not directly relate to data privacy or security controls required by GDPR or HIPAA, as it affects network packet handling rather than data storage or access.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Since this is a kernel driver bug, apply the latest kernel updates from your distribution. If using a custom kernel, ensure it includes the fix for the fbnic driver's tx_lso function. Reboot the system after applying updates.

Hi! I’m here to help you understand CVE-2026-72393. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70