HIGH Introduced in 6.16
hinic3 TxLinearize OOB
CVE-2026-90145
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI7.3HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed Previously, hinic3_send_one_skb() cached the skb fragment count before calling hinic3_tx_offload(). If hinic3_tx_csum() falls back to skb_checksum_help() for unsupported tunnel packets, the skb may be linearized. Continuing to build the TX descriptor with the stale fragment count leads to a descriptor mismatch, which can trigger out-of-bounds DMA reads or IOMMU faults. Furthermore, the old code ignored the return value of skb_checksum_help(), transmitting corrupted packets with incomplete checksums upon failure. Fix this by: 1. Moving the hinic3_tx_offload() call before calculating 'num_sge' to ensure the correct fragment count is used if the SKB is linearized. 2. Propagating skb_checksum_help() errors and returning HINIC3_TX_OFFLOAD_INVALID to properly drop the skb.
02KernelScan AI Analysis
Risk summary
Systems using Huawei hinic3 network cards are vulnerable to out-of-bounds DMA reads when transmitting certain tunnel packets, potentially leaking kernel memory or causing system crashes via IOMMU faults. Any local user with network access can trigger this by sending crafted tunnel packets; if the host forwards traffic, remote packets may also trigger the bug. The fix ensures the correct fragment count is used after any buffer linearization and properly drops packets when checksum offload fails.
Vulnerability analysis
The hinic3 network driver caches the number of socket buffer fragments before performing transmit-time checksum offload processing. When the offload code encounters an unsupported tunnel packet, it calls a helper that may linearize the buffer—collapsing multiple fragments into one—but the already-cached fragment count is now stale. The transmit descriptor is then built with the old, larger count, causing the network card to perform DMA reads beyond the valid buffer, which can leak memory contents or crash the system through a memory protection fault. A second defect silently ignored failures from the checksum helper, sending packets with incomplete checksums. The fix reorders processing so the fragment count is read only after any linearization occurs, and propagates checksum-helper errors so affected packets are dropped instead of transmitted corrupted. The vulnerable path is reached by any local user sending crafted tunnel packets through a hinic3 network interface, or by a remote packet if the host forwards traffic; no special privileges are required beyond normal network access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.16 | 7.2.6 | 96c395977038 |
| mainline | 6.16 | 7.3-rc1 | d0c2bed6927c |
| 6.18 | 6.16 | 6.18.52 | e794cdc5c369 |