CVE-2026-72339

Received Received - Intake

Buffer Overflow in Linux Kernel qede Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build_skb failure qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(). When it returns NULL under memory pressure, the functions still consume a BD from the ring before returning NULL. The callers then recycle additional BDs, resulting in one extra BD being consumed (off-by-one). This desynchronizes the BD ring, which can corrupt DMA page reference counts and lead to SLUB freelist corruption. Commit 4e910dbe3650 ("qede: confirm skb is allocated before using") added a NULL check inside qede_build_skb() to prevent a NULL pointer dereference, but did not address the missing NULL checks in the callers, making this off-by-one reachable. Fix this by adding NULL checks for the return value of qede_build_skb() in both qede_rx_build_skb() and qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring manipulation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72339

EUVD

EUVD-2026-59238

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	qede	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the qede driver where functions qede_rx_build_skb() and qede_tpa_rx_build_skb() fail to check for NULL returns from qede_build_skb(). Under memory pressure, this causes an off-by-one error in BD ring consumption, leading to BD ring desynchronization and potential SLUB freelist corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's qede driver and may not have direct detection commands. Monitor kernel logs for errors related to qede, DMA, or SLUB corruption. Check for unexpected BD ring desynchronization or page reference count issues using kernel debugging tools like ftrace or perf.

Impact Analysis

This vulnerability can cause system instability, crashes, or data corruption due to SLUB freelist corruption. It may also lead to denial-of-service conditions if the kernel fails to handle memory pressure correctly.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory management issue in the Linux qede driver. It could indirectly impact compliance if exploited to cause system instability or data corruption, but no evidence suggests direct regulatory implications.

Mitigation Strategies

Apply the kernel patch that adds NULL checks in qede_rx_build_skb() and qede_tpa_rx_build_skb(). Update to a fixed kernel version where this issue is resolved. If immediate patching is not possible, consider disabling the qede driver if not in use to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-72339. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70