CVE-2026-68354 (GCVE-0-2026-68354)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-19 16:34
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment also closes the gap to the next or previous list entry. Those neighbor lookups currently assume that the current fragment always has a real next or previous fragment. At a list edge, the next or previous entry is the list head, not a struct fwnet_fragment_info. The gap checks also compare against the old edge of the current fragment instead of the edge after adding the new fragment. As a result, a fragment that bridges two existing ranges may leave two adjacent ranges unmerged, so fwnet_pd_is_complete() can miss a complete datagram. Check for the list head before looking up the neighboring fragment, and compare the neighbor against the new fragment's far edge when deciding whether to merge all three ranges. This issue was found by a static analysis checker and confirmed by manual source review.
References
Impacted products
Vendor Product Version
Linux Linux Version: c76acec6d55107b652a37c90b36c00bc8b04dabb
Version: c76acec6d55107b652a37c90b36c00bc8b04dabb
Version: c76acec6d55107b652a37c90b36c00bc8b04dabb
Version: c76acec6d55107b652a37c90b36c00bc8b04dabb
Version: c76acec6d55107b652a37c90b36c00bc8b04dabb
Version: c76acec6d55107b652a37c90b36c00bc8b04dabb
Version: c76acec6d55107b652a37c90b36c00bc8b04dabb
Version: c76acec6d55107b652a37c90b36c00bc8b04dabb
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firewire/net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1aaf16031d65ccd4576451a79f7dabbec994c111",
              "status": "affected",
              "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb",
              "versionType": "git"
            },
            {
              "lessThan": "0a219b2a01b4fe93706717e3bcacf7f62967b26f",
              "status": "affected",
              "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb",
              "versionType": "git"
            },
            {
              "lessThan": "268cea3800eda5fa3ee04a49ee2973b8766a8df3",
              "status": "affected",
              "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb",
              "versionType": "git"
            },
            {
              "lessThan": "b7d633c7c92321be98724b1d365e8ce507f2f349",
              "status": "affected",
              "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb",
              "versionType": "git"
            },
            {
              "lessThan": "22e05b8ddbcf7d22c7f1598786e86635547e554d",
              "status": "affected",
              "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb",
              "versionType": "git"
            },
            {
              "lessThan": "0177e578d7a885037b0fb82286c12e9d0360cc10",
              "status": "affected",
              "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb",
              "versionType": "git"
            },
            {
              "lessThan": "2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999",
              "status": "affected",
              "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb",
              "versionType": "git"
            },
            {
              "lessThan": "d52a13adbb8ccbab99cd3bad36804e87d8b5c052",
              "status": "affected",
              "version": "c76acec6d55107b652a37c90b36c00bc8b04dabb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firewire/net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: net: Fix fragmented datagram reassembly\n\nfwnet_frag_new() keeps a sorted list of received fragments for a partial\ndatagram. When a new fragment is adjacent to an existing fragment, the\ncode checks whether the new fragment also closes the gap to the next or\nprevious list entry.\n\nThose neighbor lookups currently assume that the current fragment always\nhas a real next or previous fragment. At a list edge, the next or\nprevious entry is the list head, not a struct fwnet_fragment_info.\n\nThe gap checks also compare against the old edge of the current fragment\ninstead of the edge after adding the new fragment. As a result, a\nfragment that bridges two existing ranges may leave two adjacent ranges\nunmerged, so fwnet_pd_is_complete() can miss a complete datagram.\n\nCheck for the list head before looking up the neighboring fragment, and\ncompare the neighbor against the new fragment\u0027s far edge when deciding\nwhether to merge all three ranges.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable reassembly code processes IP-over-1394 (RFC 2734) fragments arriving from another node on the shared IEEE 1394 bus via fwnet_receive_packet/fwnet_receive_broadcast -\u003e fwnet_incoming_packet -\u003e fwnet_pd_update -\u003e fwnet_frag_new, matching this CNA\u0027s Adjacent shared-physical-segment model for FireWire (CVE-2023-53432, CVE-2024-50113).\nAC:L - The attacker fully controls fg_off, dg_size and fragment ordering (12-bit fields, 0-4095) and can create unlimited fresh partial datagrams, so they can sweep every boundary offset against the aliased pd-\u003eskb bits and groom skb allocation until the type-confused compare matches; once it does, the list-head corruption and misaligned kfree are deterministic, with no attacker-uncontrollable race involved.\nPR:N - fwnet_receive_packet accepts TCODE_WRITE_BLOCK_REQUEST payloads from any bus peer and fwnet_receive_broadcast processes GASP packets automatically, with no credentials, capability check, or authentication anywhere on the path to fwnet_frag_new.\nUI:N - Fragment reassembly runs entirely in FireWire IRQ/softirq context once the firewire-net interface is up; the attacker\u0027s own node supplies the fragments and no victim action such as opening, mounting, or clicking is needed.\nS:U - The corruption is confined to kernel slab objects (fwnet_partial_datagram, sk_buff) under the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - list_entry() on the list head reads the low 32 bits of pd-\u003eskb as fragment metadata (a kernel-pointer disclosure primitive), the missed merge lets fwnet_pd_is_complete() hand up an skb whose unwritten gaps contain uninitialized heap data, and the resulting slab freelist corruption from kfree() of an interior pointer yields overlapping objects usable for arbitrary kernel memory read.\nI:H - The prepend branch performs fi2-\u003elen += fi-\u003elen + len directly into bits 16-31 of pd-\u003eskb, giving a partially attacker-influenced write to a kernel pointer that is later passed to dev_kfree_skb_any() (arbitrary free), while the append branch\u0027s kfree() of pd+16 corrupts the SLUB freelist into attacker-groomable overlapping allocations - both classic control-flow-hijack primitives.\nA:H - list_del() on the list head leaves pd-\u003efi_list poisoned, and the immediately following fwnet_pd_is_complete() dereferences LIST_POISON1 in interrupt context while holding dev-\u003elock with IRQs disabled, oopsing or hanging the machine; the misaligned kfree() also trips slab debug BUGs, and a bus peer can repeat the packet flood to crash the system at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:34:00.740Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1aaf16031d65ccd4576451a79f7dabbec994c111"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a219b2a01b4fe93706717e3bcacf7f62967b26f"
        },
        {
          "url": "https://git.kernel.org/stable/c/268cea3800eda5fa3ee04a49ee2973b8766a8df3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7d633c7c92321be98724b1d365e8ce507f2f349"
        },
        {
          "url": "https://git.kernel.org/stable/c/22e05b8ddbcf7d22c7f1598786e86635547e554d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0177e578d7a885037b0fb82286c12e9d0360cc10"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999"
        },
        {
          "url": "https://git.kernel.org/stable/c/d52a13adbb8ccbab99cd3bad36804e87d8b5c052"
        }
      ],
      "title": "firewire: net: Fix fragmented datagram reassembly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68354",
    "datePublished": "2026-08-10T12:03:31.348Z",
    "dateReserved": "2026-07-30T09:28:09.385Z",
    "dateUpdated": "2026-08-19T16:34:00.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.