Executive brief
The hinic3 Ethernet driver in the Linux kernel has a bug in packet transmission that can cause network adapter malfunctions or data corruption. When the driver processes certain types of network packets for transmission, it may incorrectly calculate packet structure information or send packets with incomplete checksums, potentially leading to dropped connections, corrupted data, or system errors on servers and appliances using affected network adapters.
Technical details
The vulnerability is a logic error in the hinic3 TX (transmit) path affecting skb (socket buffer) processing. The root cause involves two flaws: (1) the fragment count is cached before calling hinic3_tx_offload(), which may linearize the skb via skb_checksum_help(), resulting in a stale fragment count being used for TX descriptor construction, leading to out-of-bounds DMA reads or IOMMU faults; (2) the return value of skb_checksum_help() is ignored, allowing corrupted packets with incomplete checksums to be transmitted on failure. The fix reorders function calls to calculate fragment count after offload processing and properly propagates checksum helper errors. No authentication or special privileges are required to trigger this—any network traffic processed by an affected driver is at risk. A patch is available in upstream Linux kernel commits d0c2bed6927cbfa2cb51f240b4812bf6916bce0e and later stable series.
Affected products
- Linux Linux kernel Affected in versions prior to upstream fix d0c2bed6927cbfa2cb51f240b4812bf6916bce0e; impacts all stable series carrying the hinic3 driver
Timeline
- 2026-09-17: disclosed: CVE-2026-90145 published
- 2026-08-11: patched: Fix developed and committed upstream (d0c2bed6927cbfa2cb51f240b4812bf6916bce0e)
- 2026-09-14: patched: Fix integrated into stable kernel series