CVE-2026-98239: net: lan743x: fix RX checksum use-after-free
In the Linux kernel, the following vulnerability has been resolved:
net: lan743x: fix RX checksum use-after-free
lan743xrxprocessbuffer() adds each non-first receive buffer to the head skb's fraglist. On the last descriptor, lan743xrxtrimskb() linearizes the head and frees the fragment skb metadata.
The checksum-success path then writes ipsummed through the local skb pointer, which still points to the final fragment. This causes a use-after-free write when a packet spans more than one receive buffer.
Set ipsummed on the surviving head skb instead. Multi-buffer receive can occur after a live MTU increase because existing ring entries keep their old buffer size until they are replenished.
A KUnit test invoking lan743xrxprocessbuffer() with a two-buffer packet produced a one-byte KASAN use-after-free write before this change. The same test passed after the change. The driver object also builds with W=1. This was not tested on physical LAN743x hardware.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the LAN743x RX path, update lan743x_rx_trim_skb() on the last descriptor to set ip_summed on the surviving head skb instead of the local skb pointer that still points to the freed final fragment.
Event History
Frequently Asked Questions
What level of access would an attacker need to attempt exploitation?
The CVSS vector indicates network reachability, with no privileges or user interaction required. Exploitation complexity is rated high.
Which deployments are most likely to be exposed?
Systems running the Linux LAN743x network driver are relevant. The vulnerable path is reached when received traffic spans multiple receive buffers, a condition noted after a live MTU increase while ring entries still use the prior buffer size.
Was the fix validated on physical hardware?
No. The change was validated with a KUnit two-buffer-packet test and built with W=1, but it was not tested on physical LAN743x hardware.