CVE-2026-45977

In the Linux kernel, the following vulnerability has been resolved:

fbnic: close fw_log race between users and teardown

Fixes a theoretical race on fw_log between the teardown path and fw_log

write functions.

fw_log is written inside fbnic_fw_log_write() and can be reached from

the mailbox handler fbnic_fw_msix_intr(), but fw_log is freed before

IRQ/MBX teardown during cleanup, resulting in a potential data race of

dereferencing a freed/null variable.

Possible Interleaving Scenario:

CPU0: fbnic_fw_msix_intr() // Entry

fbnic_fw_log_write()

if (fbnic_fw_log_ready()) // true

... preempt ...

CPU1: fbnic_remove() // Entry

fbnic_fw_log_free()

vfree(log->data_start);

log->data_start = NULL;

CPU0: continues, walks log->entries or writes to log->data_start

The initialization also has an incorrect order problem, as the fw_log

is currently allocated after MBX setup during initialization.

Fix the problems by adjusting the synchronization order to put

initialization in place before the mailbox is enabled, and not cleared

until after the mailbox has been disabled.