Executive brief
A security vulnerability has been identified in the Linux kernel's fbnic network driver, which is used for certain high-performance network interfaces. If the network device fails to initialize correctly, the system may continue to reference memory that has already been released. This could allow a local attacker to cause a system crash or potentially gain unauthorized access to sensitive data.
Technical details
A use-after-free (UAF) vulnerability exists in the fbnic driver within the Linux kernel's AF_XDP implementation. The flaw occurs in the __fbnic_open() function in drivers/net/ethernet/meta/fbnic/fbnic_netdev.c; when the device fails to open, the driver fails to clear NAPI pointers from the network interface queues before freeing the NAPI resources. This leads to a UAF condition during subsequent xsk_bind() calls when __sk_mark_napi_id_once() attempts to access the freed NAPI structure. The issue has been resolved by ensuring fbnic_reset_netif_queues() is called during the error handling path of the open operation. Patches are available in stable kernel releases 6.15.10 and 6.16.1.
Affected products
- Linux Linux Kernel 6.14 to 6.15.10, 6.16 to 6.16.1
Timeline
- 2025-08-19: disclosed
- 2025-08-19: advisory
- 2025-08-15: patched