PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45952 Linux CVE debrief

A vulnerability in the Linux kernel's fbnic (Facebook/Meta network interface controller) driver allowed MTU increases after XDP attachment, causing multi-fragment packet drops. The driver previously blocked XDP attachment when MTU was too high but failed to prevent post-attachment MTU changes. When MTU exceeds the HDS (Header/Data Split) threshold, hardware fragments packets across multiple buffers; single-buffer XDP programs then drop all multi-frag frames, breaking TCP streams. The fix adds validation to prevent MTU changes that would exceed this threshold while XDP is active.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Organizations running Linux systems with Meta/Facebook fbnic network hardware using XDP for packet processing, particularly those with custom MTU configurations or dynamic network tuning.

Technical summary

The fbnic driver in the Linux kernel did not validate MTU changes after XDP program attachment. When MTU exceeds the HDS threshold, hardware fragments incoming packets. Single-buffer XDP programs cannot process multi-fragment frames, resulting in silent packet drops. This breaks new TCP streams and degrades network performance. The vulnerability is local (configuration change) with network impact. The fix adds runtime validation to reject MTU increases that would exceed the HDS threshold while XDP is attached.

Defensive priority

medium

Recommended defensive actions

  • Review systems using fbnic (Meta/Facebook NIC) hardware with XDP programs enabled
  • Verify kernel version includes the validation fix (check stable kernel updates with commits referenced in source material)
  • Audit network configurations for MTU changes on interfaces with active XDP attachments
  • Monitor for unexpected packet drops on TCP streams when XDP is in use
  • Apply kernel updates from distribution stable channels when available

Evidence notes

CVE description confirms the vulnerability exists in the fbnic Ethernet driver. The issue is a logic gap: XDP attachment was blocked at high MTU, but MTU could still be increased afterward. Three kernel.org stable commits are referenced, indicating backports to stable kernel branches. No CVSS score or severity assigned yet (status: Awaiting Analysis per NVD).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45952 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45952

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45952 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45952

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/03399063aa0c67fd8bdfd69467ddb849bb3b97df

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ccd8e87748ad083047d6c8544c5809b7f96cc8df

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d7eaa006c0444a5d4671be7efe6dbb33ef8b515e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.