CVE-2026-90145hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed Previously, hinic3_send_one_skb() cached the skb fragment count before calling hinic3_tx_offload(). If hinic3_tx_csum() falls back to skb_checksum_help() for unsupported tunnel packets, the skb may be linearized. Continuing to build the TX descriptor with the stale fragment count leads to a descriptor mismatch, which can trigger out-of-bounds DMA reads or IOMMU faults. Furthermore, the old code ignored the return value of skb_checksum_help(), transmitting corrupted packets with incomplete checksums upon failure. Fix this by: 1. Moving the hinic3_tx_offload() call before calculating 'num_sge' to ensure the correct fragment count is used if the SKB is linearized. 2. Propagating skb_checksum_help() errors and returning HINIC3_TX_OFFLOAD_INVALID to properly drop the skb.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d before e794cdc5c369c1b06359e2fe03a8d9270f56bead; from 17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d before 96c3959770386b2913c62005f0d0c3151e0c01c3; from 17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d before d0c2bed6927cbfa2cb51f240b4812bf6916bce0e | CNA record |
References
- https://git.kernel.org/stable/c/e794cdc5c369c1b06359e2fe03a8d9270f56bead
- https://git.kernel.org/stable/c/96c3959770386b2913c62005f0d0c3151e0c01c3
- https://git.kernel.org/stable/c/d0c2bed6927cbfa2cb51f240b4812bf6916bce0e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.