Executive brief
A race condition was identified in the Linux kernel's fbnic network driver. This flaw could allow a local user with sufficient privileges to trigger a system crash or instability during the removal or teardown of the network device. The issue occurs because the system may attempt to write to a logging component after it has already been cleared from memory.
Technical details
A race condition exists in the fbnic driver between the teardown path (`fbnic_remove`) and firmware logging write functions (`fbnic_fw_log_write`). The `fw_log` structure is freed before the IRQ/Mailbox (MBX) teardown is complete. If an interrupt occurs via `fbnic_fw_msix_intr` during this window, the handler may attempt to dereference `log->data_start` after it has been set to NULL or freed by `vfree`. Additionally, an initialization order issue was identified where `fw_log` was allocated after the mailbox setup. The fix reorders initialization to occur before the mailbox is enabled and ensures logging is disabled before the mailbox and memory are cleared during teardown.
Affected products
- Linux Linux kernel fbnic driver
Timeline
- 2026-02-11: other: Patch submitted by author
- 2026-02-26: patched: Commits merged into stable trees
- 2026-05-27: disclosed: CVE published