Linux Kernel EUVD-2026-55455

The vulnerability resides in drivers/firewire/net.c within the Linux kernel's IEEE 1394 (FireWire) networking subsystem, present since version 2.6.31. The fwnet_frag_new() function maintains a sorted doubly-linked list of received datagram fragment ranges to track reassembly progress for each partial datagram. The defect is a dual boundary-condition error: first, when checking whether a newly inserted fragment is adjacent to its neighbors, the code does not guard against the neighboring entry being the list head (struct list_head) rather than a real struct fwnet_fragment_info - dereferencing the list head as if it were a fragment structure constitutes type confusion that can corrupt kernel memory. Second, the adjacency gap comparison uses the original fragment edge rather than the edge after the new fragment is merged in, so a single incoming fragment that bridges two pre-existing ranges may leave those ranges unmerged. The downstream effect is that fwnet_pd_is_complete() may fail to recognize a fully received datagram, producing resource leaks or, in the type-confusion path, kernel-level memory safety violations. CWE is not formally assigned, but the root cause maps to improper linked-list boundary checking (analogous to CWE-754). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* from 2.6.31 through the patched stable releases.