---
id: CVE-2026-90145
title: >-
  In the Linux kernel, the following vulnerability has been resolved:


  hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help()
  failed


  Previously, hinic3_send_one_skb() cached the skb fragment count before

  calling hini…
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help()
  failed


  Previously, hinic3_send_one_skb() cached the skb fragment count before

  calling hini…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d <
    e794cdc5c369c1b06359e2fe03a8d9270f56bead
  - >-
    Linux >= 17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d <
    96c3959770386b2913c62005f0d0c3151e0c01c3
  - >-
    Linux >= 17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d <
    d0c2bed6927cbfa2cb51f240b4812bf6916bce0e
  - Linux 6.16
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:43.853'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90145'
references:
  - url: 'https://git.kernel.org/stable/c/96c3959770386b2913c62005f0d0c3151e0c01c3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d0c2bed6927cbfa2cb51f240b4812bf6916bce0e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e794cdc5c369c1b06359e2fe03a8d9270f56bead'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00157
epssPercentile: 0.05291
ingestedAt: '2026-09-17T16:21:47.876Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed

Previously, hinic3_send_one_skb() cached the skb fragment count before
calling hinic3_tx_offload(). If hinic3_tx_csum() falls back to
skb_checksum_help() for unsupported tunnel packets, the skb may be
linearized. Continuing to build the TX descriptor with the stale
fragment count leads to a descriptor mismatch, which can trigger
out-of-bounds DMA reads or IOMMU faults.

Furthermore, the old code ignored the return value of skb_checksum_help(),
transmitting corrupted packets with incomplete checksums upon failure.

Fix this by:
1. Moving the hinic3_tx_offload() call before calculating 'num_sge' to
   ensure the correct fragment count is used if the SKB is linearized.
2. Propagating skb_checksum_help() errors and returning
   HINIC3_TX_OFFLOAD_INVALID to properly drop the skb.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.