CVE-2026-45977: Linux Kernel Race Condition Vulnerability

CVE-2026-45977 Overview

CVE-2026-45977 is a race condition vulnerability in the Linux kernel's fbnic network driver. The flaw exists between the firmware log (fw_log) teardown path and the fw_log write functions. An interrupt handler can dereference fw_log data structures after they have been freed during device removal. This creates a use-after-free condition with potential for kernel memory corruption or null pointer dereference.

The vulnerability was resolved in upstream Linux by reordering the fw_log lifecycle so initialization occurs before the mailbox is enabled and cleanup occurs only after the mailbox is disabled.

Critical Impact
Concurrent execution between fbnic_fw_msix_intr() and fbnic_remove() can dereference freed memory in the fw_log structure, leading to kernel instability or memory corruption.

Affected Products

Linux kernel versions containing the fbnic driver with the unfixed fw_log synchronization ordering
Systems using Meta's fbnic Ethernet NIC driver
Kernel branches prior to the commits referenced in the upstream fix

Discovery Timeline

2026-05-27 - CVE-2026-45977 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45977

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the fbnic network driver's firmware logging subsystem. The driver writes firmware log entries inside fbnic_fw_log_write(), which is reachable from the mailbox interrupt handler fbnic_fw_msix_intr(). During device teardown, fbnic_fw_log_free() releases the log buffer via vfree(log->data_start) and sets log->data_start = NULL. The teardown sequence freed the log before disabling the interrupt and mailbox, allowing concurrent access from a different CPU.

In the interleaving scenario, CPU0 enters fbnic_fw_msix_intr() and passes the fbnic_fw_log_ready() check. CPU0 is then preempted while CPU1 executes fbnic_remove() and frees the log buffer. When CPU0 resumes, it walks log->entries or writes into log->data_start, which now points to freed or null memory.

Root Cause

The root cause is incorrect synchronization order between resource lifetime and interrupt enablement. The fw_log buffer was allocated after mailbox setup and freed before mailbox teardown, leaving a window in which the interrupt handler could legitimately fire against destroyed state. The upstream patch reorders initialization to allocate fw_log before the mailbox is enabled and to free it only after the mailbox is disabled, eliminating the race window.

Attack Vector

Triggering the race requires the firmware to deliver mailbox interrupts concurrent with driver removal. Exploitation is described upstream as theoretical, since the timing window is narrow and depends on device unbind or module unload occurring while firmware traffic is in flight. A local privileged actor able to unbind or remove the driver under load could potentially induce the race. The vulnerability does not provide a remote attack surface.

The fix involves reordering the calls to fbnic_fw_log_alloc() and fbnic_fw_log_free() relative to the mailbox enable and disable operations. Refer to the Linux Kernel Commit 223cfef, Linux Kernel Commit 5f10ab3, and Linux Kernel Commit ee5492f for the exact code changes.

Detection Methods for CVE-2026-45977

Indicators of Compromise

Kernel oops or panic with a stack trace including fbnic_fw_log_write and fbnic_fw_msix_intr during module unload or device unbind
Null pointer dereference reports referencing log->data_start in fbnic driver code paths
Unexpected kernel crashes correlated with fbnic device removal events in dmesg

Detection Strategies

Audit running kernel versions on hosts equipped with fbnic NICs and compare against the patched commit hashes
Monitor kernel ring buffer and system journals for fbnic driver fault traces during device lifecycle events
Use modinfo fbnic and package metadata to confirm whether the driver in use includes the upstream fix

Monitoring Recommendations

Forward kernel logs (/var/log/kern.log, journald) to a centralized log platform and alert on fbnic fault signatures
Track driver bind, unbind, and module load events as part of host telemetry to correlate with stability incidents
Include kernel version inventory in vulnerability management scans for fleets using Meta fbnic hardware

How to Mitigate CVE-2026-45977

Immediate Actions Required

Apply the upstream Linux kernel patches that reorder fw_log initialization and teardown relative to mailbox setup
Update to a stable Linux kernel release that incorporates commits 223cfef, 5f10ab3, and ee5492f
Restrict privileged operations such as driver unbind and module unload to authorized administrators

Patch Information

The fix is committed upstream in the Linux kernel stable tree. The patch moves fbnic_fw_log_alloc() to execute before mailbox enablement and fbnic_fw_log_free() to execute after mailbox disablement, eliminating the window in which fbnic_fw_msix_intr() can race with teardown. See Linux Kernel Commit 223cfef, Linux Kernel Commit 5f10ab3, and Linux Kernel Commit ee5492f.

Workarounds

Avoid unbinding or removing the fbnic driver on production systems under firmware load until patches are applied
Limit access to /sys/bus/pci/drivers/fbnic/unbind and module management interfaces to the root user
Schedule maintenance windows for driver operations rather than performing them on running workloads

bash

# Verify running kernel version and check for fbnic driver presence
uname -r
modinfo fbnic | grep -E 'version|filename'

# Restrict module unload capability to root only (default on most distros)
ls -l /sbin/rmmod /sbin/modprobe