{"id":"CVE-2026-98239","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: fix RX checksum use-after-free\n\nlan743x_rx_process_buffer() adds each non-first receive buffer to the\nhead skb's frag_list","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: fix RX checksum use-after-free\n\nlan743x_rx_process_buffer() adds each non-first receive buffer to the\nhead skb's frag_list.  On the last descriptor, lan74…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a < 0e52886c4324c9897c2c62f92be3dc8316cee67e","Linux >= cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a < a58024835c704419bb46d2a34e5223f65605f958","Linux >= cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a < 6fe5c3a2503983abb431d93faeadfc7f5e6a7e33","Linux >= cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a < 5c216bfa9fb7b36804485e67975e9c98055b31ef","Linux >= cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a < 161a403c8625e152de03d1da22bbf9cda6dc9f9f","Linux >= cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a < a9ce4053dc945c5372dedba5017ee675b30dc0c5","Linux 6.1"],"published":"2026-10-06","updated":"2026-10-07","sourceUpdated":"2026-10-07T07:17:05.810","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98239","references":[{"url":"https://git.kernel.org/stable/c/0e52886c4324c9897c2c62f92be3dc8316cee67e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/161a403c8625e152de03d1da22bbf9cda6dc9f9f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c216bfa9fb7b36804485e67975e9c98055b31ef","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fe5c3a2503983abb431d93faeadfc7f5e6a7e33","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a58024835c704419bb46d2a34e5223f65605f958","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a9ce4053dc945c5372dedba5017ee675b30dc0c5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98239.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98239"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546529"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98239"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98239"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98239.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00435,"epssPercentile":0.37638,"ingestedAt":"2026-10-06T08:50:17.433Z","cwe":["CWE-825"],"scores":{"nvd":8.1,"vendor":7,"cna":8.1},"slug":"CVE-2026-98239","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: fix RX checksum use-after-free\n\nlan743x_rx_process_buffer() adds each non-first receive buffer to the\nhead skb's frag_list.  On the last descriptor, lan743x_rx_trim_skb()\nlinearizes the head and frees the fragment skb metadata.\n\nThe checksum-success path then writes ip_summed through the local skb\npointer, which still points to the final fragment.  This causes a\nuse-after-free write when a packet spans more than one receive buffer.\n\nSet ip_summed on the surviving head skb instead.  Multi-buffer receive\ncan occur after a live MTU increase because existing ring entries keep\ntheir old buffer size until they are replenished.\n\nA KUnit test invoking lan743x_rx_process_buffer() with a two-buffer\npacket produced a one-byte KASAN use-after-free write before this change.\nThe same test passed after the change.  The driver object also builds\nwith W=1.  This was not tested on physical LAN743x hardware.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98239.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":217282,"id":"CVE-2026-98239","ts":1791361306191,"field":"cvss","old":null,"new":"8.1"},{"seq":217281,"id":"CVE-2026-98239","ts":1791361306191,"field":"severity","old":"none","new":"high"}]}