Executive brief
A vulnerability in the Linux kernel's fbnic network driver could allow a local user to inadvertently disrupt network traffic. By increasing the Maximum Transmission Unit (MTU) beyond a specific threshold while a high-performance packet processing tool (XDP) is active, the system may begin dropping valid incoming data packets. This results in a denial-of-service condition for new network connections, potentially impacting the availability of services relying on that network interface.
Technical details
The fbnic driver in the Linux kernel failed to validate MTU changes when an XDP (eXpress Data Path) program was already attached. If the MTU is increased beyond the Header Data Split (HDS) threshold, the hardware fragments packets across multiple buffers. Because the driver's single-buffer XDP implementation does not support multi-fragment frames, it drops these packets. While the driver previously prevented attaching XDP if the MTU was already high, it lacked a check to prevent increasing the MTU after XDP was active. An attacker or administrator with privileges to change network settings could trigger this condition, leading to a denial-of-service for incoming traffic. The fix introduces 'fbnic_change_mtu' to validate that new MTU settings do not exceed the HDS threshold when XDP is enabled.
Affected products
- Linux Linux Kernel fbnic driver versions prior to 2026-02-26 patches
Timeline
- 2026-02-14: other: Patch authored
- 2026-02-26: patched: Patch committed to stable tree
- 2026-05-27: advisory: CVE published