eth: fbnic: don't cache shinfo across skb realloc (CVE-2026-72393) | HOL Guard CVE

Critical · CVSS 9.8CVE-2026-72393

eth: fbnic: don't cache shinfo across skb realloc

Answer in brief

CVE-2026-72393 records a Critical severity (CVSS 9.8) vulnerability in eth: fbnic: don't cache shinfo across skb realloc. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 15, 2026Updated Aug 17, 2026Source checked Sep 29, 2026First seen by HOL Aug 15, 2026Material review Aug 17, 2026

Upstream Advisory

Key facts

Risk: Critical · CVSS 9.8
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=b0b0f52042acb324cd39fbefb2b1ae83af8f8ae1 <83df3e2594cd78aa40b1246a19879abb4891945b \|\| >=b0b0f52042acb324cd39fbefb2b1ae83af8f8ae1 <21f304c2aae46625e050c28d979f4b9d83faa85e \|\| >=b0b0f52042acb324cd39fbefb2b1ae83af8f8ae1 <62b68b774f06bf52e329f254f0199bc43d350ccf	83df3e2594cd78aa40b1246a19879abb4891945b, 21f304c2aae46625e050c28d979f4b9d83faa85e, 62b68b774f06bf52e329f254f0199bc43d350ccf
Linux/Linuxgeneric	6.15	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 83df3e2594cd78aa40b1246a19879abb4891945b if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 15, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in fbnic_tx_lso.isra.0+0x668/0x8e0 Read of size 4 at addr ff110000262edd98 by task swapper/5/0 Call Trace: fbnic_tx_lso.isra.0+0x668/0x8e0 fbnic_xmit_frame+0x622/0xba0 dev_hard_start_xmit+0xf4/0x620 Allocated by task 8653: __alloc_skb+0x11e/0x5f0 alloc_skb_with_frags+0xcc/0x6c0 sock_alloc_send_pskb+0x327/0x3f0 __ip_append_data+0x188b/0x47a0 ip_make_skb+0x24a/0x300 udp_sendmsg+0x14d2/0x21e0 Freed by task 0: kfree+0x123/0x5a0 pskb_expand_head+0x36c/0xfa0 fbnic_tx_lso.isra.0+0x500/0x8e0 fbnic_xmit_frame+0x622/0xba0 dev_hard_start_xmit+0xf4/0x620 sch_direct_xmit+0x25b/0x1100 The buggy address belongs to the object at ff110000262edc40 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 344 bytes inside of freed 640-byte region [ff110000262edc40, ff110000262ede

Quoted source text, attributed separately from HOL analysis.