Linux Kernel CVE-2026-98239

Exploitation requires the host to use a Microchip LAN743x (lan7430/lan7431) Ethernet controller and is limited to the specific path lan743x_rx_process_buffer() → lan743x_rx_trim_skb(). The bug ONLY triggers when a single received packet spans more than one RX buffer (frag_list is populated), which per the description occurs only transiently after a live MTU increase, because existing ring entries keep their old (smaller) buffer size until replenished. Limiting factors: the attacker does not control the MTU change (operator action), the vulnerable window is short-lived until the ring is refilled, and the driver's presence is hardware-dependent. Per CVSS PR:N the attacker is unauthenticated, but reaching the RX path realistically requires same-segment/adjacent network access to deliver oversized frames.

Signals are mixed and point to a LOW real-world priority despite the high 8.1 CVSS. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) rates full Confidentiality/Integrity/Availability impact with high attack complexity, which is why the base score is high. However, EPSS is only 0.18% (7th percentile), the CVE is NOT on CISA KEV, and no public exploit code is identified - so exploitation probability is very low. Crucially, the high CVSS C:H/I:H/A:H impact is a theoretical ceiling for a one-byte kernel-heap use-after-free write; translating that into reliable disclosure or code execution is non-trivial. The dominant mitigating factor is the narrow trigger window: the bug only manifests on multi-buffer receives, which the description says occur only after a live MTU increase while stale ring entries retain their old buffer size. That is an operator-initiated, transient condition the attacker does not control, so AC:H is well-justified and arguably understates the difficulty. Conflict to verify with vendor: AV:N implies remote network triggering, but the vulnerability is confined to the niche Microchip LAN743x Ethernet driver AND depends on an administrator having just changed the MTU - effectively a local/operational precondition that the AV:N metric does not capture.

An attacker on the same L2 segment as a host using a Microchip LAN743x NIC waits for (or induces) a live MTU increase on that interface, then sends frames large enough to span multiple RX buffers before the ring is replenished, triggering a use-after-free write in lan743x_rx_process_buffer() on the checksum-success path. In the best case for the attacker this corrupts kernel heap memory adjacent to the freed fragment skb, potentially leading to a crash (DoS) or, far less reliably, memory corruption. No public exploit exists; the only demonstrated trigger is an in-tree KUnit test using a two-buffer packet, and the fix was never validated on physical hardware.