HIGH Introduced in 6.1
lan743x RxChecksum UAF
CVE-2026-98239
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743x_rx_process_buffer() adds each non-first receive buffer to the head skb's frag_list. On the last descriptor, lan743x_rx_trim_skb() linearizes the head and frees the fragment skb metadata. The checksum-success path then writes ip_summed through the local skb pointer, which still points to the final fragment. This causes a use-after-free write when a packet spans more than one receive buffer. Set ip_summed on the surviving head skb instead. Multi-buffer receive can occur after a live MTU increase because existing ring entries keep their old buffer size until they are replenished. A KUnit test invoking lan743x_rx_process_buffer() with a two-buffer packet produced a one-byte KASAN use-after-free write before this change. The same test passed after the change. The driver object also builds with W=1. This was not tested on physical LAN743x hardware.
02KernelScan AI Analysis
Risk summary
Devices with Microchip LAN743x Ethernet controllers are vulnerable to a use-after-free write in the receive path when multi-buffer packets are processed after an MTU increase. A network attacker who can send suitably sized packets to the interface during this window can trigger kernel heap memory corruption, potentially leading to code execution or system crash. The vulnerability requires the LAN743x driver to be loaded and the interface to be receiving traffic after a recent MTU change.
Vulnerability analysis
The LAN743x Ethernet driver's receive checksum offload path writes to a network buffer that has already been freed. When a packet spans multiple receive buffers—something that happens after a live MTU increase while the ring still holds smaller buffers—the driver linearizes the head buffer and releases the fragment metadata, but the checksum code then writes through a stale pointer to the freed fragment. The fix redirects the checksum flag write to the surviving head buffer. An attacker on the network can trigger this by sending a suitably sized packet to a LAN743x interface whose MTU was recently raised, causing a use-after-free write in kernel heap memory.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 6.1 | 6.1.189 | 0e52886c4324 |
| 6.6 | 6.1 | 6.6.158 | a58024835c70 |
| 6.12 | 6.1 | 6.12.112 | 6fe5c3a25039 |
| 6.18 | 6.1 | 6.18.54 | 5c216bfa9fb7 |
| 7.2 | 6.1 | 7.2.8 | 161a403c8625 |
| mainline | 6.1 | 7.3-rc4 | a9ce4053dc94 |