CVE-2026-45952: Linux Kernel fbnic Driver DoS Vulnerability

CVE-2026-45952 Overview

CVE-2026-45952 is a Linux kernel vulnerability in the fbnic Ethernet driver. The driver fails to validate Maximum Transmission Unit (MTU) changes after an eXpress Data Path (XDP) program is attached. Increasing the MTU beyond the Header-Data Split (HDS) threshold causes the hardware to fragment packets across multiple buffers. Single-buffer XDP programs then drop all multi-frag frames, breaking TCP streams.

Critical Impact
A misconfigured MTU change on an interface running a single-buffer XDP program causes the driver to drop multi-fragment frames, disrupting TCP connectivity on affected hosts.

Affected Products

Linux kernel fbnic network driver
Systems running XDP programs on Meta fbnic network interfaces
Kernel versions prior to commits 03399063, ccd8e877, and d7eaa006

Discovery Timeline

2026-05-27 - CVE-2026-45952 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45952

Vulnerability Analysis

The fbnic driver supports XDP for fast packet processing in the kernel. Traditionally, drivers support XDP only when the MTU stays below 4 KB so each packet fits in a single page. The fbnic driver enforces this constraint at XDP attach time by rejecting attachment when the MTU is too high.

The enforcement is incomplete. The driver does not validate MTU changes performed after XDP has been attached. An administrator or orchestration system can raise the MTU above the HDS threshold while a single-buffer XDP program is running.

Once the MTU crosses that threshold, the hardware fragments incoming packets across multiple receive buffers. The XDP program receives multi-fragment frames it cannot process, and the driver drops them. TCP streams using the larger MTU stop working. Non-TCP traffic from remote senders larger than the negotiated MTU is also discarded.

Root Cause

The root cause is missing input validation on the .ndo_change_mtu path in fbnic. The driver checks XDP compatibility when a program is attached but does not re-check when the MTU changes. This is a configuration-state consistency flaw rather than a memory safety issue.

Attack Vector

Exploitation requires local administrative privileges to change the interface MTU. There is no remote attack vector. The realistic impact is operational: an operator inadvertently breaks TCP connectivity on hosts running fbnic with XDP. Remote senders cannot directly trigger the condition, though they can transmit oversized packets that will be dropped once the misconfiguration exists.

No exploitation code is required to reproduce the condition. The fix in commits 03399063, ccd8e877, and d7eaa006 adds MTU validation that rejects changes incompatible with an attached single-buffer XDP program.

Detection Methods for CVE-2026-45952

Indicators of Compromise

Sudden TCP connection failures or stalled streams on hosts using fbnic interfaces after an MTU change.
Elevated receive drop counters in ethtool -S output on fbnic devices while an XDP program is attached.
Kernel log entries from the fbnic driver indicating multi-fragment frame drops under XDP.

Detection Strategies

Audit running kernel versions across the fleet and flag hosts with fbnic drivers older than the patched commits.
Correlate MTU change events with XDP attach state on the same interface to detect unsafe transitions.
Monitor for drops in rx_dropped and XDP-specific counters following any ip link set mtu operation.

Monitoring Recommendations

Collect ethtool -S and /proc/net/dev counters at regular intervals and alert on sustained drop increases.
Capture netlink interface configuration changes through audit subsystems to record MTU modifications.
Track loaded XDP programs with bpftool net show and pair the inventory with MTU values for each interface.

How to Mitigate CVE-2026-45952

Immediate Actions Required

Update affected systems to a Linux kernel that includes commits 03399063aa0c, ccd8e87748ad, or d7eaa006c044.
Identify hosts running XDP on fbnic interfaces and verify their MTU stays below the HDS threshold until patched.
Restrict MTU modification privileges to authorized configuration management systems.

Patch Information

The fix adds validation in the fbnic driver to reject MTU changes that would exceed the HDS threshold while a single-buffer XDP program is attached. See the upstream commits: Kernel commit 03399063, Kernel commit ccd8e877, and Kernel commit d7eaa006.

Workarounds

Detach the XDP program before changing the MTU, then reattach it after confirming the new value is within supported bounds.
Pin the interface MTU to a value below the HDS threshold through configuration management when XDP is in use.
Use multi-buffer XDP programs where supported so multi-fragment frames are handled correctly.

bash

# Safely change MTU on an fbnic interface running XDP
IFACE=eth0
bpftool net detach xdp dev $IFACE
ip link set dev $IFACE mtu 1500
bpftool prog load /path/to/xdp_prog.o /sys/fs/bpf/xdp_prog
bpftool net attach xdp pinned /sys/fs/bpf/xdp_prog dev $IFACE