Ubuntu patches Linux kernel (NVIDIA BaseOS) network flaws
The notice covers issues in network drivers and IPv4 networking tracked as CVE-2026-98239 and CVE-2026-98432.
46
CVE-2026-98239
Use-after-free in Linux kernel lan743x RX checksum
- CVSS 3.1
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free write in the Linux kernel lan743x Ethernet driver occurs when a received packet spans more than one buffer. On the last descriptor, lan743x_rx_trim_skb() linearizes the head skb and frees fragment metadata, but the checksum-success path still writes ip_summed through a pointer to the freed final fragment. Multi-buffer receives can happen after a live MTU increase because existing ring entries keep their old buffer size until replenished. A KUnit test produced a one-byte KASAN use-after-free write; CVSS 8.1 rates the network-reachable issue high for confidentiality, integrity, and availability, though attack complexity is high and it was not tested on physical LAN743x hardware. No public proof of concept is known and it is not listed in CISA KEV.
What to do: Install a Linux kernel that includes the upstream lan743x fix, which sets ip_summed on the surviving head skb instead of the freed fragment. Until that kernel is deployed, avoid live MTU increases on interfaces using the lan743x driver, and treat unexpected kernel crashes or KASAN reports on those NICs as possible signs of this bug.
| Product | Affected |
|---|---|
| Linux kernel (lan743x driver for Microchip LAN743x Ethernet) | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743x_rx_process_buffer() adds each non-first receive buffer to the head skb's frag_list. On the last descriptor, lan743x_rx_trim_skb() linearizes the head and frees the fragment skb metadata. The checksum-success path then writes ip_summed through the local skb pointer, which still points to the final fragment. This causes a use-after-free write when a packet spans more than one receive buffer. Set ip_summed on the surviving head skb instead. Multi-buffer receive can occur after a live MTU increase because existing ring entries keep their old buffer size until they are replenished. A KUnit test invoking lan743x_rx_process_buffer() with a two-buffer packet produced a one-byte KASAN use-after-free write before this change. The same test passed after the change. The driver object also builds with W=1. This was not tested on physical LAN743x hardware.
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H