CVE-2026-90145 (GCVE-0-2026-90145)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:53
VLAI
Title
hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
Summary
In the Linux kernel, the following vulnerability has been resolved: hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed Previously, hinic3_send_one_skb() cached the skb fragment count before calling hinic3_tx_offload(). If hinic3_tx_csum() falls back to skb_checksum_help() for unsupported tunnel packets, the skb may be linearized. Continuing to build the TX descriptor with the stale fragment count leads to a descriptor mismatch, which can trigger out-of-bounds DMA reads or IOMMU faults. Furthermore, the old code ignored the return value of skb_checksum_help(), transmitting corrupted packets with incomplete checksums upon failure. Fix this by: 1. Moving the hinic3_tx_offload() call before calculating 'num_sge' to ensure the correct fragment count is used if the SKB is linearized. 2. Propagating skb_checksum_help() errors and returning HINIC3_TX_OFFLOAD_INVALID to properly drop the skb.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d , < e794cdc5c369c1b06359e2fe03a8d9270f56bead (git)
Affected: 17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d , < 96c3959770386b2913c62005f0d0c3151e0c01c3 (git)
Affected: 17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d , < d0c2bed6927cbfa2cb51f240b4812bf6916bce0e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/huawei/hinic3/hinic3_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e794cdc5c369c1b06359e2fe03a8d9270f56bead",
              "status": "affected",
              "version": "17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d",
              "versionType": "git"
            },
            {
              "lessThan": "96c3959770386b2913c62005f0d0c3151e0c01c3",
              "status": "affected",
              "version": "17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d",
              "versionType": "git"
            },
            {
              "lessThan": "d0c2bed6927cbfa2cb51f240b4812bf6916bce0e",
              "status": "affected",
              "version": "17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/huawei/hinic3/hinic3_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed\n\nPreviously, hinic3_send_one_skb() cached the skb fragment count before\ncalling hinic3_tx_offload(). If hinic3_tx_csum() falls back to\nskb_checksum_help() for unsupported tunnel packets, the skb may be\nlinearized. Continuing to build the TX descriptor with the stale\nfragment count leads to a descriptor mismatch, which can trigger\nout-of-bounds DMA reads or IOMMU faults.\n\nFurthermore, the old code ignored the return value of skb_checksum_help(),\ntransmitting corrupted packets with incomplete checksums upon failure.\n\nFix this by:\n1. Moving the hinic3_tx_offload() call before calculating \u0027num_sge\u0027 to\n   ensure the correct fragment count is used if the SKB is linearized.\n2. Propagating skb_checksum_help() errors and returning\n   HINIC3_TX_OFFLOAD_INVALID to properly drop the skb."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in hinic3_send_one_skb(), reached only from hinic3_xmit_frame (ndo_start_xmit). Stale num_sge is caused by skb_checksum_help() linearizing a locally built encapsulated skb with SKBFL_SHARED_FRAG (sendfile/splice into GRE/Geneve/IPIP); no received protocol message supplies that fragment layout.\nAC:L - An attacker can sendfile/splice a non-GSO CHECKSUM_PARTIAL frame onto a non-VXLAN tunnel so hinic3_tx_csum() takes the unsupported-tunnel branch (l4_proto != UDP or dest != 4789) and skb_checksum_help() linearizes shared frags, desynchronizing the cached nr_frags with no race.\nPR:L - sendfile/splice on ordinary sockets needs no capability. On a host whose egress is a Geneve/GRE/IPIP overlay over hinic3, that traffic is encapsulated in-kernel and reaches hinic3_xmit_frame as an unprivileged local user (including from a container), without init-namespace CAP_NET_ADMIN.\nUI:N - The attacker triggers hinic3_tx_csum() by transmitting their own splice\u0027d skb; no other user must mount media, open a file, or change configuration.\nS:U - hinic3_prepare_sq_ctrl() programs a wrong BUFDESC_NUM so the NIC DMA-reads leftover SQ buf_descs in host kernel context; that is not a guest-to-host escape, and unmapped IOVAs fault rather than bypass IOMMU policy.\nC:H - After skb_checksum_help() drops nr_frags, hinic3_tx_map_skb() fills only the remaining fragments while hinic3_prepare_sq_ctrl() still advertises the cached num_sge, so the NIC DMA-reads uninitialized SQ buf_descs (stale addresses/lengths) and can emit that host memory on the wire.\nI:N - SQ buf_descs carry only address/length for DMA_TO_DEVICE. hinic3_tx_map_skb() walks the post-linearize nr_frags and does not write out of bounds in the WQE, so there is no kernel write or control-flow primitive.\nA:H - The same stale BUFDESC_NUM makes the device DMA from leftover or unmapped IOVAs, which the fix describes as out-of-bounds DMA reads and IOMMU faults, and can stall the send queue when hardware walks garbage descriptors."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:22.491Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e794cdc5c369c1b06359e2fe03a8d9270f56bead"
        },
        {
          "url": "https://git.kernel.org/stable/c/96c3959770386b2913c62005f0d0c3151e0c01c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0c2bed6927cbfa2cb51f240b4812bf6916bce0e"
        }
      ],
      "title": "hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90145",
    "datePublished": "2026-09-17T16:06:41.055Z",
    "dateReserved": "2026-09-11T19:38:34.789Z",
    "dateUpdated": "2026-09-18T17:53:22.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90145",
      "date": "2026-09-26",
      "epss": "0.00164",
      "percentile": "0.05002"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/huawei/hinic3/hinic3_tx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e794cdc5c369c1b06359e2fe03a8d9270f56bead",
                    "status": "affected",
                    "version": "17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "96c3959770386b2913c62005f0d0c3151e0c01c3",
                    "status": "affected",
                    "version": "17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d0c2bed6927cbfa2cb51f240b4812bf6916bce0e",
                    "status": "affected",
                    "version": "17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/huawei/hinic3/hinic3_tx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed\n\nPreviously, hinic3_send_one_skb() cached the skb fragment count before\ncalling hinic3_tx_offload(). If hinic3_tx_csum() falls back to\nskb_checksum_help() for unsupported tunnel packets, the skb may be\nlinearized. Continuing to build the TX descriptor with the stale\nfragment count leads to a descriptor mismatch, which can trigger\nout-of-bounds DMA reads or IOMMU faults.\n\nFurthermore, the old code ignored the return value of skb_checksum_help(),\ntransmitting corrupted packets with incomplete checksums upon failure.\n\nFix this by:\n1. Moving the hinic3_tx_offload() call before calculating \u0027num_sge\u0027 to\n   ensure the correct fragment count is used if the SKB is linearized.\n2. Propagating skb_checksum_help() errors and returning\n   HINIC3_TX_OFFLOAD_INVALID to properly drop the skb."
          }
        ],
        "id": "CVE-2026-90145",
        "lastModified": "2026-09-18T18:17:43.853",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:07.350",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/96c3959770386b2913c62005f0d0c3151e0c01c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d0c2bed6927cbfa2cb51f240b4812bf6916bce0e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e794cdc5c369c1b06359e2fe03a8d9270f56bead"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:32:17Z",
      "cve": "CVE-2026-90145",
      "id": "CVE-2026-90145",
      "initial_release_date": "2026-09-21T16:32:17Z",
      "product_status:known_not_affected": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90145",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90145.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.