CVE-2026-90145 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
Previously, hinic3_send_one_skb() cached the skb fragment count before calling hinic3_tx_offload(). If hinic3_tx_csum() falls back to skb_checksum_help() for unsupported tunnel packets, the skb may be linearized. Continuing to build the TX descriptor with the stale fragment count leads to a descriptor mismatch, which can trigger out-of-bounds DMA reads or IOMMU faults.
Furthermore, the old code ignored the return value of skb_checksum_help(), transmitting corrupted packets with incomplete checksums upon failure.
Fix this by: 1. Moving the hinic3_tx_offload() call before calculating 'num_sge' to ensure the correct fragment count is used if the SKB is linearized. 2. Propagating skb_checksum_help() errors and returning HINIC3_TX_OFFLOAD_INVALID to properly drop the skb.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The hinic3 network driver in the Linux kernel contained a critical logic error within its transmit path that could lead to severe stability issues, including system crashes or security vulnerabilities related to memory safety. The core of the issue lies in how the driver handles Scatter-Gather Engine (SGE) descriptors for transmitted packets. Specifically, the function hinic3_send_one_skb was caching the fragment count of the socket buffer before invoking the transmission offload routine. This sequence is problematic because certain network conditions can trigger a linearization process that alters the memory layout and fragmentation structure of the packet data in flight.
When processing tunnel encapsulated packets or other complex scenarios where hardware checksum offloading is not supported, the driver falls back to using skb_checksum_help() to compute the checksum software-side. This function may need to linearize the socket buffer if it was previously fragmented for performance reasons. Linearization involves copying fragment data into a contiguous memory area and updating the internal state of the sk_buff structure. However, because the hinic3 driver had already cached the original fragment count prior to this potential transformation, it proceeded to build the TX descriptor using stale information that no longer reflected the actual memory layout.
This mismatch between the cached fragment count and the actual linearized buffer results in an incorrect number of Scatter-Gather Elements being passed to the hardware DMA engine. Consequently, the network interface card may attempt to read from or write to physical memory addresses beyond the bounds of the allocated packet data. This out-of-bounds DMA access can trigger IOMMU faults, leading to device errors and potential kernel panics due to invalid memory operations. From a security perspective, this represents an Out-of-Bounds Read vulnerability as defined by CWE-125, where the system accesses memory beyond intended boundaries, potentially exposing sensitive data or causing denial of service through resource exhaustion or crash conditions.
Furthermore, the original implementation exhibited poor error handling regarding the return value of skb_checksum_help(). If the function failed to compute the checksum correctly, perhaps due to insufficient memory allocation during linearization, the driver ignored this failure and proceeded to transmit the packet anyway. This results in network packets being sent with incomplete or incorrect checksums, which can cause connectivity issues for downstream receivers that validate packet integrity strictly. While not a direct vulnerability in the traditional sense of code execution, it degrades service reliability and violates proper protocol compliance standards.
The resolution involves reordering operations within the transmission path to ensure data consistency before descriptor construction. The driver now calls hinic3_tx_offload() prior to calculating the number of Scatter-Gather Elements required for the TX descriptor. This ensures that if linearization occurs, the subsequent calculation uses the updated fragment count from the linearized buffer rather than stale pre-offload values. Additionally, the fix implements strict error propagation by checking the return value of skb_checksum_help(). If this function fails, the driver now returns HINIC3_TX_OFFLOAD_INVALID, which signals the upper layers to drop the corrupted socket buffer instead of transmitting it with bad checksums.
This mitigation aligns with best practices for secure network driver development as outlined in various industry standards regarding memory management and error handling. It addresses CWE-20 Improper Input Validation by ensuring that internal state is consistent before use, and mitigates risks associated with CWE-787 Out-of-Bounds Write if the descriptor mismatch led to writing beyond buffer limits during DMA setup. The ATT&CK technique T1496 Resource Hijacking via Denial of Service is relevant here, as unhandled memory faults can lead to system instability affecting availability. By correcting the order of operations and enforcing strict error checking, the patch restores both the stability and integrity of network transmissions on systems utilizing hinic3 hardware.