CVE-2026-72339 - Vulnerability Details

- qede: fix off-by-one in BD ring consumption on build_skb failure

Description

In the Linux kernel, the following vulnerability has been resolved:

qede: fix off-by-one in BD ring consumption on build_skb failure

qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions still consume a BD from the ring before
returning NULL. The callers then recycle additional BDs, resulting in
one extra BD being consumed (off-by-one). This desynchronizes the BD
ring, which can corrupt DMA page reference counts and lead to SLUB
freelist corruption.

Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")
added a NULL check inside qede_build_skb() to prevent a NULL pointer
dereference, but did not address the missing NULL checks in the
callers, making this off-by-one reachable.

Fix this by adding NULL checks for the return value of
qede_build_skb() in both qede_rx_build_skb() and
qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring
manipulation.

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An off‑by‑one error in the Linux kernel’s qede driver consumes a buffer descriptor when packet reception fails, desynchronizing the BD ring and corrupting the SLUB free‑list. This manifests as kernel memory corruption, which can trigger a kernel panic. The weakness is classified as CWE‑193. The bug originates from missing NULL checks after a call to qede_build_skb(), causing an unintended BD ring manipulation. While the description does not indicate privilege escalation, the corruption could disrupt kernel operations.

Affected Systems

The flaw affects any Linux kernel that includes the qede driver. No specific kernel version range is listed, and the vulnerability has been addressed only in a later commit. Systems that rely on network packets processed by a qede‑enabled interface are susceptible.

Risk and Exploitability

The CVSS score of 9.8 classifies this as a critical vulnerability. The EPSS score of < 1% indicates a very low probability of exploitation in the wild. This vulnerability is not listed in CISA’s KEV catalog. Based on the description, the bug is reachable only when the kernel receives packet traffic on a qede‑enabled interface, suggesting a network‑based attack vector that is inferred rather than explicitly stated.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< ecc05d4b20220a09c9c69584fc46ca55248a374a
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 07be8b8adf91b7ada4c3dacce064d572a6066421
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 1624aa100c0b218181aa74e3696a389b509298cb
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 0bf78df2d3ecb1f4964ff42a7327d25845955153
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 814a5edac8c9fc04051808d5faaa93768e989281
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< b066420e57f3402a52c998678b4678252ac9bb63
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 982d6d6bc059c5dff37a2201c2f08c14bcfcbd20
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f

Linux

affected

Version	Status	Constraints
`4.18`	affected	—
`0`	unaffected	< 4.18
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,ecc05d4b20220a09c9c69584fc46ca55248a374a)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,07be8b8adf91b7ada4c3dacce064d572a6066421)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,1624aa100c0b218181aa74e3696a389b509298cb)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,0bf78df2d3ecb1f4964ff42a7327d25845955153)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,814a5edac8c9fc04051808d5faaa93768e989281)`	affected	code_commit	—
`[8a8633978b842c88fbcfe07e5dde96048f630e,b066420e57f3402a52c998678b4678252ac9bb63)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,982d6d6bc059c5dff37a2201c2f08c14bcfcbd20)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.18`	affected	generic	—
`[0,4.18)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the patch from commit 4e910dbe or a later kernel release that includes the NULL‑check fixes in qede_rx_build_skb() and qede_tpa_rx_build_skb().
If a kernel upgrade is not immediately feasible, disable or unload the qede driver to block the vulnerable code path.
Alternatively, backport the upstream patch into the running kernel if a full update cannot be performed.

Generated by OpenCVE AI on August 22, 2026 at 10:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00745.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/07be8b8adf91b7ada4c3dacce064d572a6066421
https://git.kernel.org/stable/c/0bf78df2d3ecb1f4964ff42a7327d25845955153
https://git.kernel.org/stable/c/1624aa100c0b218181aa74e3696a389b509298cb
https://git.kernel.org/stable/c/814a5edac8c9fc04051808d5faaa93768e989281
https://git.kernel.org/stable/c/982d6d6bc059c5dff37a2201c2f08c14bcfcbd20
https://git.kernel.org/stable/c/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f
https://git.kernel.org/stable/c/b066420e57f3402a52c998678b4678252ac9bb63
https://git.kernel.org/stable/c/ecc05d4b20220a09c9c69584fc46ca55248a374a
https://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-72339-ca7a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72339
https://www.cve.org/CVERecord?id=CVE-2026-72339

History

Sat, 22 Aug 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-787

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-193
References		https://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-72339-ca7a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72339 https://www.cve.org/CVERecord?id=CVE-2026-72339
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 17 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

Mon, 17 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 11:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build_skb failure qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(). When it returns NULL under memory pressure, the functions still consume a BD from the ring before returning NULL. The callers then recycle additional BDs, resulting in one extra BD being consumed (off-by-one). This desynchronizes the BD ring, which can corrupt DMA page reference counts and lead to SLUB freelist corruption. Commit 4e910dbe3650 ("qede: confirm skb is allocated before using") added a NULL check inside qede_build_skb() to prevent a NULL pointer dereference, but did not address the missing NULL checks in the callers, making this off-by-one reachable. Fix this by adding NULL checks for the return value of qede_build_skb() in both qede_rx_build_skb() and qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring manipulation.
Title		qede: fix off-by-one in BD ring consumption on build_skb failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/07be8b8adf91b7ada4c3dacce064d572a6066421 https://git.kernel.org/stable/c/0bf78df2d3ecb1f4964ff42a7327d25845955153 https://git.kernel.org/stable/c/1624aa100c0b218181aa74e3696a389b509298cb https://git.kernel.org/stable/c/814a5edac8c9fc04051808d5faaa93768e989281 https://git.kernel.org/stable/c/982d6d6bc059c5dff37a2201c2f08c14bcfcbd20 https://git.kernel.org/stable/c/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f https://git.kernel.org/stable/c/b066420e57f3402a52c998678b4678252ac9bb63 https://git.kernel.org/stable/c/ecc05d4b20220a09c9c69584fc46ca55248a374a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:55:46.480Z

Updated: 2026-08-17T05:42:57.907Z

Reserved: 2026-08-09T03:40:39.920Z

Link: CVE-2026-72339

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:07.150

Modified: 2026-08-17T06:18:37.623

Link: CVE-2026-72339

Redhat

Severity : Important

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72339 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T10:15:04Z

Weaknesses

CWE-193
Off-by-one Error

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object