CVE-2026-72393: eth: fbnic: don't cache shinfo across skb realloc

CVE-2026-72393: eth: fbnic: don't cache shinfo across skb realloc

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

eth: fbnic: don't cache shinfo across skb realloc

fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb
including the shared info. We can't use the pointer calculated
before the call.

    BUG: KASAN: slab-use-after-free in fbnic_tx_lso.isra.0+0x668/0x8e0
    Read of size 4 at addr ff110000262edd98 by task swapper/5/0
    Call Trace:
     fbnic_tx_lso.isra.0+0x668/0x8e0
     fbnic_xmit_frame+0x622/0xba0
     dev_hard_start_xmit+0xf4/0x620

    Allocated by task 8653:
     __alloc_skb+0x11e/0x5f0
     alloc_skb_with_frags+0xcc/0x6c0
     sock_alloc_send_pskb+0x327/0x3f0
     __ip_append_data+0x188b/0x47a0
     ip_make_skb+0x24a/0x300
     udp_sendmsg+0x14d2/0x21e0

    Freed by task 0:
     kfree+0x123/0x5a0
     pskb_expand_head+0x36c/0xfa0
     fbnic_tx_lso.isra.0+0x500/0x8e0
     fbnic_xmit_frame+0x622/0xba0
     dev_hard_start_xmit+0xf4/0x620
     sch_direct_xmit+0x25b/0x1100

    The buggy address belongs to the object at ff110000262edc40
     which belongs to the cache skbuff_small_head of size 640
    The buggy address is located 344 bytes inside of
     freed 640-byte region [ff110000262edc40, ff110000262ede

The Linux kernel CVE team has assigned CVE-2026-72393 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.15 with commit b0b0f52042acb324cd39fbefb2b1ae83af8f8ae1 and fixed in 6.18.40 with commit 83df3e2594cd78aa40b1246a19879abb4891945b
	Issue introduced in 6.15 with commit b0b0f52042acb324cd39fbefb2b1ae83af8f8ae1 and fixed in 7.1.5 with commit 21f304c2aae46625e050c28d979f4b9d83faa85e
	Issue introduced in 6.15 with commit b0b0f52042acb324cd39fbefb2b1ae83af8f8ae1 and fixed in 7.2-rc2 with commit 62b68b774f06bf52e329f254f0199bc43d350ccf

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72393
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/meta/fbnic/fbnic_txrx.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/83df3e2594cd78aa40b1246a19879abb4891945b
	https://git.kernel.org/stable/c/21f304c2aae46625e050c28d979f4b9d83faa85e
	https://git.kernel.org/stable/c/62b68b774f06bf52e329f254f0199bc43d350ccf