{"id":7035,"date":"2026-09-04T18:49:24","date_gmt":"2026-09-04T10:49:24","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72393"},"modified":"2026-09-04T18:49:24","modified_gmt":"2026-09-04T10:49:24","slug":"cve-2026-72393","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72393","title":{"rendered":"CVE-2026-72393 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: don&#8217;t cac"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>eth: fbnic: don&#8217;t cache shinfo across skb realloc<\/p>\n<p>fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb<br \/>\nincluding the shared info. We can&#8217;t use the pointer calculated<br \/>\nbefore the call.<\/p>\n<p>    BUG: KASAN: slab-use-after-free in fbnic_tx_lso.isra.0+0x668\/0x8e0<br \/>\n    Read of size 4 at addr ff110000262edd98 by task swapper\/5\/0<br \/>\n    Call Trace:<br \/>\n     fbnic_tx_lso.isra.0+0x668\/0x8e0<br \/>\n     fbnic_xmit_frame+0x622\/0xba0<br \/>\n     dev_hard_start_xmit+0xf4\/0x620<\/p>\n<p>    Allocated by task 8653:<br \/>\n     __alloc_skb+0x11e\/0x5f0<br \/>\n     alloc_skb_with_frags+0xcc\/0x6c0<br \/>\n     sock_alloc_send_pskb+0x327\/0x3f0<br \/>\n     __ip_append_data+0x188b\/0x47a0<br \/>\n     ip_make_skb+0x24a\/0x300<br \/>\n     udp_sendmsg+0x14d2\/0x21e0<\/p>\n<p>    Freed by task 0:<br \/>\n     kfree+0x123\/0x5a0<br \/>\n     pskb_expand_head+0x36c\/0xfa0<br \/>\n     fbnic_tx_lso.isra.0+0x500\/0x8e0<br \/>\n     fbnic_xmit_frame+0x622\/0xba0<br \/>\n     dev_hard_start_xmit+0xf4\/0x620<br \/>\n     sch_direct_xmit+0x25b\/0x1100<\/p>\n<p>    The buggy address belongs to the object at ff110000262edc40<br \/>\n     which belongs to the cache skbuff_small_head of size 640<br \/>\n    The buggy address is located 344 bytes inside of<br \/>\n     freed 640-byte region [ff110000262edc40, ff110000262ede<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>eth: fbnic: don&#8217;t cache shinfo across skb realloc<\/p>\n<p>fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb<br \/>\nincluding the s<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7035","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}