firewire: net: Fix fragmented datagram reassembly

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-68354
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-10 13:20:27 UTC
Updated2026-08-10 13:20:27 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment also closes the gap to the next or previous list entry. Those neighbor lookups currently assume that the current fragment always has a real next or previous fragment. At a list edge, the next or previous entry is the list head, not a struct fwnet_fragment_info. The gap checks also compare against the old edge of the current fragment instead of the edge after adding the new fragment. As a result, a fragment that bridges two existing ranges may leave two adjacent ranges unmerged, so fwnet_pd_is_complete() can miss a complete datagram. Check for the list head before looking up the neighboring fragment, and compare the neighbor against the new fragment's far edge when deciding whether to merge all three ranges. This issue was found by a static analysis checker and confirmed by manual source review.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c76acec6d55107b652a37c90b36c00bc8b04dabb b7d633c7c92321be98724b1d365e8ce507f2f349 git Not specified
CNA Linux Linux affected c76acec6d55107b652a37c90b36c00bc8b04dabb 22e05b8ddbcf7d22c7f1598786e86635547e554d git Not specified
CNA Linux Linux affected c76acec6d55107b652a37c90b36c00bc8b04dabb 0177e578d7a885037b0fb82286c12e9d0360cc10 git Not specified
CNA Linux Linux affected c76acec6d55107b652a37c90b36c00bc8b04dabb 2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999 git Not specified
CNA Linux Linux affected c76acec6d55107b652a37c90b36c00bc8b04dabb d52a13adbb8ccbab99cd3bad36804e87d8b5c052 git Not specified
CNA Linux Linux affected 2.6.31 Not specified
CNA Linux Linux unaffected 2.6.31 semver Not specified
CNA Linux Linux unaffected 6.6.148 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.101 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.42 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.6 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc5 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/0177e578d7a885037b0fb82286c12e9d0360cc10 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d52a13adbb8ccbab99cd3bad36804e87d8b5c052 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b7d633c7c92321be98724b1d365e8ce507f2f349 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/22e05b8ddbcf7d22c7f1598786e86635547e554d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report