CVE-2026-98239

A flaw was found in the Linux kernel's LAN743x network device driver. This vulnerability allows an attacker capable of transmitting network traffic to an affected system to cause a Denial of Service (DoS) or memory corruption. The issue occurs because the driver attempts to update checksum information on a packet buffer that has already been freed during multi-buffer receive handling, resulting in a use-after-free condition.

A confirmed use-after-free write occurs in the LAN743x receive path when a packet spans multiple receive buffers. lan743x_rx_trim_skb linearizes the head skb and frees fragment skb metadata, but the local skb pointer can still reference the final freed fragment. The checksum success path then writes CHECKSUM_UNNECESSARY to the freed ip_summed field, producing a one-byte kernel heap write. A network sender can potentially reach this path with a suitable multi-buffer packet after a live MTU increase leaves existing receive ring entries with their previous buffer size. For the CVSS the PR:N value is used because the sender does not need an account or privileges on the target system, although an administrator normally creates the required MTU transition state. AV:A and AC:H reflect the need for access through an adjacent LAN743x network path and the additional interface state and timing conditions. Impact is at least denial of service through kernel memory corruption and a possible crash. The confirmed write after free also creates a plausible but unproven path to confidentiality or integrity impact if the freed skb storage is reused for another kernel object.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.