CVE-2026-72393 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
eth: fbnic: don't cache shinfo across skb realloc
fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb including the shared info. We can't use the pointer calculated before the call.
BUG: KASAN: slab-use-after-free in fbnic_tx_lso.isra.0+0x668/0x8e0 Read of size 4 at addr ff110000262edd98 by task swapper/5/0 Call Trace: fbnic_tx_lso.isra.0+0x668/0x8e0 fbnic_xmit_frame+0x622/0xba0 dev_hard_start_xmit+0xf4/0x620
Allocated by task 8653: __alloc_skb+0x11e/0x5f0 alloc_skb_with_frags+0xcc/0x6c0 sock_alloc_send_pskb+0x327/0x3f0 __ip_append_data+0x188b/0x47a0 ip_make_skb+0x24a/0x300 udp_sendmsg+0x14d2/0x21e0
Freed by task 0: kfree+0x123/0x5a0 pskb_expand_head+0x36c/0xfa0 fbnic_tx_lso.isra.0+0x500/0x8e0 fbnic_xmit_frame+0x622/0xba0 dev_hard_start_xmit+0xf4/0x620 sch_direct_xmit+0x25b/0x1100
The buggy address belongs to the object at ff110000262edc40 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 344 bytes inside of freed 640-byte region [ff110000262edc40, ff110000262ede
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a use-after-free condition in the fbnic network driver within the Linux kernel, specifically affecting the fbnic_tx_lso() function. This issue arises from improper handling of shared socket buffer information structures during packet transmission operations. The flaw manifests when skb_cow_head() is invoked, which can cause reallocation of the socket buffer including its shared info structure. The driver attempts to cache a pointer to this shared info before the potential reallocation occurs but fails to account for the fact that the memory location may become invalid after the reallocation process.
The technical implementation issue stems from the driver's failure to properly manage memory references when dealing with socket buffer operations that may result in memory reallocation. When the fbnic_tx_lso() function processes packets for Large Segment Offload (LSO), it calls skb_cow_head() which can trigger a reallocation of the underlying socket buffer structure. The shared info pointer that was calculated prior to this call becomes stale and points to freed memory, creating a classic use-after-free scenario that allows for potential memory corruption or arbitrary code execution.
This vulnerability directly impacts system stability and security by enabling an attacker to potentially exploit the use-after-free condition through crafted network packets. The kernel's memory management subsystem detects this violation through KASAN (Kernel Address Sanitizer) which identifies the read operation occurring at address ff110000262edd98, confirming that memory has been freed but is still being accessed. The allocation and deallocation traces show a clear pattern where the socket buffer's shared info structure is allocated by __alloc_skb() and subsequently freed by kfree() during pskb_expand_head() execution, creating a window where the cached pointer becomes invalid.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable privilege escalation or denial-of-service conditions within kernel space. Attackers could leverage this flaw by sending specially crafted network packets that trigger the vulnerable code path, causing the driver to access freed memory locations and potentially executing arbitrary code with kernel privileges. This type of vulnerability aligns with CWE-416 Use After Free, which specifically addresses improper handling of memory after it has been freed, and represents a critical security concern for systems utilizing the fbnic network driver.
Mitigation strategies should focus on implementing proper pointer validation and reinitialization following memory reallocation operations. The recommended solution involves updating the fbnic_tx_lso() function to recalculate all cached shared info pointers immediately after any potential skb reallocation occurs, ensuring that references point to valid memory locations. Additionally, system administrators should apply the relevant kernel security patches that address this specific use-after-free condition and monitor for similar patterns in other network drivers that may exhibit similar memory management issues. The vulnerability demonstrates the importance of careful memory management in kernel space and adherence to security best practices as outlined in various cybersecurity frameworks including those addressing memory safety concerns in operating system components.
The root cause analysis reveals a fundamental flaw in how the driver handles socket buffer operations where assumptions about memory stability are violated during reallocation scenarios. This pattern represents a common class of vulnerabilities in kernel networking code where developers assume that cached pointers remain valid across function calls that may alter underlying data structures. The fix requires careful attention to the exact sequence of operations and proper synchronization of pointer references with actual memory states, preventing the stale pointer dereference that leads to the use-after-free condition. This vulnerability underscores the critical need for comprehensive testing of kernel network drivers under stress conditions and thorough code reviews focused on memory management patterns in high-performance kernel subsystems.