CVE-2026-68354: firewire: net: Fix fragmented datagram reassembly

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

firewire: net: Fix fragmented datagram reassembly

fwnet_frag_new() keeps a sorted list of received fragments for a partial
datagram. When a new fragment is adjacent to an existing fragment, the
code checks whether the new fragment also closes the gap to the next or
previous list entry.

Those neighbor lookups currently assume that the current fragment always
has a real next or previous fragment. At a list edge, the next or
previous entry is the list head, not a struct fwnet_fragment_info.

The gap checks also compare against the old edge of the current fragment
instead of the edge after adding the new fragment. As a result, a
fragment that bridges two existing ranges may leave two adjacent ranges
unmerged, so fwnet_pd_is_complete() can miss a complete datagram.

Check for the list head before looking up the neighboring fragment, and
compare the neighbor against the new fragment's far edge when deciding
whether to merge all three ranges.

This issue was found by a static analysis checker and confirmed by
manual source review.

The Linux kernel CVE team has assigned CVE-2026-68354 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.31 with commit c76acec6d55107b652a37c90b36c00bc8b04dabb and fixed in 6.6.148 with commit b7d633c7c92321be98724b1d365e8ce507f2f349
	Issue introduced in 2.6.31 with commit c76acec6d55107b652a37c90b36c00bc8b04dabb and fixed in 6.12.101 with commit 22e05b8ddbcf7d22c7f1598786e86635547e554d
	Issue introduced in 2.6.31 with commit c76acec6d55107b652a37c90b36c00bc8b04dabb and fixed in 6.18.42 with commit 0177e578d7a885037b0fb82286c12e9d0360cc10
	Issue introduced in 2.6.31 with commit c76acec6d55107b652a37c90b36c00bc8b04dabb and fixed in 7.1.6 with commit 2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999
	Issue introduced in 2.6.31 with commit c76acec6d55107b652a37c90b36c00bc8b04dabb and fixed in 7.2-rc5 with commit d52a13adbb8ccbab99cd3bad36804e87d8b5c052

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68354
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/firewire/net.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b7d633c7c92321be98724b1d365e8ce507f2f349
	https://git.kernel.org/stable/c/22e05b8ddbcf7d22c7f1598786e86635547e554d
	https://git.kernel.org/stable/c/0177e578d7a885037b0fb82286c12e9d0360cc10
	https://git.kernel.org/stable/c/2a5aa4e9b89227d1a1690fb8d5b81e5f3b261999
	https://git.kernel.org/stable/c/d52a13adbb8ccbab99cd3bad36804e87d8b5c052