{"api_version":"1","generated_at":"2026-08-13T09:07:39+00:00","cve":"CVE-2026-68354","urls":{"html":"https://cve.report/CVE-2026-68354","api":"https://cve.report/api/cve/CVE-2026-68354.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68354","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68354"},"summary":{"title":"firewire: net: Fix fragmented datagram reassembly","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: net: Fix fragmented datagram reassembly\n\nfwnet_frag_new() keeps a sorted list of received fragments for a partial\ndatagram. When a new fragment is adjacent to an existing fragment, the\ncode checks whether the new fragment also closes the gap to the next or\nprevious list entry.\n\nThose neighbor lookups currently assume that the current fragment always\nhas a real next or previous fragment. At a list edge, the next or\nprevious entry is the list head, not a struct fwnet_fragment_info.\n\nThe gap checks also compare against the old edge of the current fragment\ninstead of the edge after adding the new fragment. As a result, a\nfragment that bridges two existing ranges may leave two adjacent ranges\nunmerged, so fwnet_pd_is_complete() can miss a complete datagram.\n\nCheck for the list head before looking up the neighboring fragment, and\ncompare the neighbor against the new fragment's far edge when deciding\nwhether to merge all three ranges.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:27","updated_at":"2026-08-10 13:20:27"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/0177e578d7a885037b0fb82286c12e9d0360cc10","name":"https://git.kernel.org/stable/c/0177e578d7a885037b0fb82286c12e9d0360cc10","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d52a13adbb8ccbab99cd3bad36804e87d8b5c052","name":"https://git.kernel.org/stable/c/d52a13adbb8ccbab99cd3bad36804e87d8b5c052","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999","name":"https://git.kernel.org/stable/c/2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b7d633c7c92321be98724b1d365e8ce507f2f349","name":"https://git.kernel.org/stable/c/b7d633c7c92321be98724b1d365e8ce507f2f349","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/22e05b8ddbcf7d22c7f1598786e86635547e554d","name":"https://git.kernel.org/stable/c/22e05b8ddbcf7d22c7f1598786e86635547e554d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68354","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68354","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c76acec6d55107b652a37c90b36c00bc8b04dabb b7d633c7c92321be98724b1d365e8ce507f2f349 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c76acec6d55107b652a37c90b36c00bc8b04dabb 22e05b8ddbcf7d22c7f1598786e86635547e554d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c76acec6d55107b652a37c90b36c00bc8b04dabb 0177e578d7a885037b0fb82286c12e9d0360cc10 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c76acec6d55107b652a37c90b36c00bc8b04dabb 2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c76acec6d55107b652a37c90b36c00bc8b04dabb d52a13adbb8ccbab99cd3bad36804e87d8b5c052 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.31","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.31 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.148 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc5 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/firewire/net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b7d633c7c92321be98724b1d365e8ce507f2f349","status":"affected","version":"c76acec6d55107b652a37c90b36c00bc8b04dabb","versionType":"git"},{"lessThan":"22e05b8ddbcf7d22c7f1598786e86635547e554d","status":"affected","version":"c76acec6d55107b652a37c90b36c00bc8b04dabb","versionType":"git"},{"lessThan":"0177e578d7a885037b0fb82286c12e9d0360cc10","status":"affected","version":"c76acec6d55107b652a37c90b36c00bc8b04dabb","versionType":"git"},{"lessThan":"2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999","status":"affected","version":"c76acec6d55107b652a37c90b36c00bc8b04dabb","versionType":"git"},{"lessThan":"d52a13adbb8ccbab99cd3bad36804e87d8b5c052","status":"affected","version":"c76acec6d55107b652a37c90b36c00bc8b04dabb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/firewire/net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc5","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.148","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc5","versionStartIncluding":"2.6.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: net: Fix fragmented datagram reassembly\n\nfwnet_frag_new() keeps a sorted list of received fragments for a partial\ndatagram. When a new fragment is adjacent to an existing fragment, the\ncode checks whether the new fragment also closes the gap to the next or\nprevious list entry.\n\nThose neighbor lookups currently assume that the current fragment always\nhas a real next or previous fragment. At a list edge, the next or\nprevious entry is the list head, not a struct fwnet_fragment_info.\n\nThe gap checks also compare against the old edge of the current fragment\ninstead of the edge after adding the new fragment. As a result, a\nfragment that bridges two existing ranges may leave two adjacent ranges\nunmerged, so fwnet_pd_is_complete() can miss a complete datagram.\n\nCheck for the list head before looking up the neighboring fragment, and\ncompare the neighbor against the new fragment's far edge when deciding\nwhether to merge all three ranges.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review."}],"providerMetadata":{"dateUpdated":"2026-08-10T12:03:31.348Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b7d633c7c92321be98724b1d365e8ce507f2f349"},{"url":"https://git.kernel.org/stable/c/22e05b8ddbcf7d22c7f1598786e86635547e554d"},{"url":"https://git.kernel.org/stable/c/0177e578d7a885037b0fb82286c12e9d0360cc10"},{"url":"https://git.kernel.org/stable/c/2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999"},{"url":"https://git.kernel.org/stable/c/d52a13adbb8ccbab99cd3bad36804e87d8b5c052"}],"title":"firewire: net: Fix fragmented datagram reassembly","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68354","datePublished":"2026-08-10T12:03:31.348Z","dateReserved":"2026-07-30T09:28:09.385Z","dateUpdated":"2026-08-10T12:03:31.348Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:27","lastModifiedDate":"2026-08-10 13:20:27","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68354","Ordinal":"1","Title":"firewire: net: Fix fragmented datagram reassembly","CVE":"CVE-2026-68354","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68354","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: net: Fix fragmented datagram reassembly\n\nfwnet_frag_new() keeps a sorted list of received fragments for a partial\ndatagram. When a new fragment is adjacent to an existing fragment, the\ncode checks whether the new fragment also closes the gap to the next or\nprevious list entry.\n\nThose neighbor lookups currently assume that the current fragment always\nhas a real next or previous fragment. At a list edge, the next or\nprevious entry is the list head, not a struct fwnet_fragment_info.\n\nThe gap checks also compare against the old edge of the current fragment\ninstead of the edge after adding the new fragment. As a result, a\nfragment that bridges two existing ranges may leave two adjacent ranges\nunmerged, so fwnet_pd_is_complete() can miss a complete datagram.\n\nCheck for the list head before looking up the neighboring fragment, and\ncompare the neighbor against the new fragment's far edge when deciding\nwhether to merge all three ranges.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review.","Type":"Description","Title":"firewire: net: Fix fragmented datagram reassembly"}]}}}