Executive brief
The Meta fbnic Ethernet driver in the Linux kernel contains a use-after-free vulnerability in its TCP Large Segment Offload (LSO) function. When transmitting large packets, the driver caches a pointer to packet metadata that becomes invalid after the packet buffer is reallocated, leading to a crash or potential code execution. This affects systems using Meta's fbnic network interface cards for high-speed packet transmission.
Technical details
The fbnic_tx_lso() function has a use-after-free vulnerability in the skb_shared_info metadata. The function initially caches a pointer to skb_shinfo before calling skb_cow_head(), which may reallocate the entire skb structure and its shared info. The cached pointer then references freed memory (KASAN slab-use-after-free). The fix moves the shinfo pointer calculation to after the skb_cow_head() call, ensuring it references the correct post-reallocation structure. Attack vectors include local packet transmission from unprivileged processes (UDP, LSO-capable sockets), with network adjacency required only if exploited from a network service. The vulnerability is present in TCP segmentation offload processing and was patched upstream in commit 62b68b774f06bf52e329f254f0199bc43d350ccf.
Affected products
- Linux Linux kernel All versions with fbnic driver support (6.0+)
Timeline
- 2026-08-15: disclosed: Public advisory published
- 2026-06-25: patched: Upstream patch committed by Jakub Kicinski
- 2026-07-24: patched: Backported to Linux stable tree