CVE-2026-45977

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbnic: close fw_log race between users and teardown

Fixes a theoretical race on fw_log between the teardown path and fw_log

write functions.

fw_log is written inside fbnic_fw_log_write() and can be reached from

the mailbox handler fbnic_fw_msix_intr(), but fw_log is freed before

IRQ/MBX teardown during cleanup, resulting in a potential data race of

dereferencing a freed/null variable.

Possible Interleaving Scenario:

CPU0: fbnic_fw_msix_intr() // Entry

fbnic_fw_log_write()

if (fbnic_fw_log_ready()) // true

... preempt ...

CPU1: fbnic_remove() // Entry

fbnic_fw_log_free()

vfree(log->data_start);

log->data_start = NULL;

CPU0: continues, walks log->entries or writes to log->data_start

The initialization also has an incorrect order problem, as the fw_log

is currently allocated after MBX setup during initialization.

Fix the problems by adjusting

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References