CVE-2026-68354

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The vulnerable reassembly code processes IP-over-1394 (RFC 2734) fragments arriving from another node on the shared IEEE 1394 bus via fwnet_receive_packet/fwnet_receive_broadcast -> fwnet_incoming_packet -> fwnet_pd_update -> fwnet_frag_new, matching this CNA's Adjacent shared-physical-segment model for FireWire (CVE-2023-53432, CVE-2024-50113).

AC:LAttack complexity, low

The attacker fully controls fg_off, dg_size and fragment ordering (12-bit fields, 0-4095) and can create unlimited fresh partial datagrams, so they can sweep every boundary offset against the aliased pd->skb bits and groom skb allocation until the type-confused compare matches; once it does, the list-head corruption and misaligned kfree are deterministic, with no attacker-uncontrollable race involved.

PR:NPrivileges required, none

fwnet_receive_packet accepts TCODE_WRITE_BLOCK_REQUEST payloads from any bus peer and fwnet_receive_broadcast processes GASP packets automatically, with no credentials, capability check, or authentication anywhere on the path to fwnet_frag_new.

UI:NUser interaction, none

Fragment reassembly runs entirely in FireWire IRQ/softirq context once the firewire-net interface is up; the attacker's own node supplies the fragments and no victim action such as opening, mounting, or clicking is needed.

S:UScope, unchanged

The corruption is confined to kernel slab objects (fwnet_partial_datagram, sk_buff) under the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

list_entry() on the list head reads the low 32 bits of pd->skb as fragment metadata (a kernel-pointer disclosure primitive), the missed merge lets fwnet_pd_is_complete() hand up an skb whose unwritten gaps contain uninitialized heap data, and the resulting slab freelist corruption from kfree() of an interior pointer yields overlapping objects usable for arbitrary kernel memory read.

I:HIntegrity impact, high

The prepend branch performs fi2->len += fi->len + len directly into bits 16-31 of pd->skb, giving a partially attacker-influenced write to a kernel pointer that is later passed to dev_kfree_skb_any() (arbitrary free), while the append branch's kfree() of pd+16 corrupts the SLUB freelist into attacker-groomable overlapping allocations - both classic control-flow-hijack primitives.

A:HAvailability impact, high

list_del() on the list head leaves pd->fi_list poisoned, and the immediately following fwnet_pd_is_complete() dereferences LIST_POISON1 in interrupt context while holding dev->lock with IRQs disabled, oopsing or hanging the machine; the misaligned kfree() also trips slab debug BUGs, and a bus peer can repeat the packet flood to crash the system at will.