CVE-2026-89511 - Vulnerability Details

- qede: Fix NULL pointer dereference in TPA fragment processing

Description

In the Linux kernel, the following vulnerability has been resolved:

qede: Fix NULL pointer dereference in TPA fragment processing

Under memory pressure, the qede driver encounters NULL pointer
dereferences when processing TPA continuation fragments.

Commit 8a8633978b84 ("qede: Add build_skb() support.") accidentally
dropped the assignment of tpa_info->buffer.data in qede_tpa_start().

When memory pressure causes an SKB allocation failure in qede_tpa_start(),
the driver sets tpa_start_fail = true and attempts to recycle the physical
page later in qede_tpa_end() via qede_reuse_page(). However, because
buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a
"ghost" BD (valid DMA mapping but NULL data pointer) back into the
active Rx ring.

The next time the hardware uses this ring slot, it passes a NULL page
to qede_fill_frag_skb(), causing a kernel panic.

Example crash from production system:
BUG: unable to handle kernel NULL pointer dereference at 0x8
RIP: qede_fill_frag_skb+0x96/0x430 [qede]
Call Trace:
qede_rx_int+0xb06/0x1de0
qede_poll+0x2f4/0x6c0
__napi_poll+0x2d/0x130

Fix the root cause by restoring the tpa_info->buffer.data assignment
in qede_tpa_start(), ensuring valid pages are correctly tracked and
recycled. Additionally, update the stale comment for
struct qede_agg_info::buffer to reflect its current usage.

Published: 2026-09-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The qede driver in the Linux kernel contains a null pointer dereference that is triggered during TPA fragment processing when memory pressure causes an SKB allocation to fail. This flaw results in an uninitialized data pointer, leading to a kernel panic and loss of availability.

Affected Systems

All Linux kernel versions that include the qede driver are affected until the fix commit 8a8633978b84 is applied. No specific version list is provided, so any kernel where the qede driver is present is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, while the EPSS score of <1% signals a very low probability that this flaw will be actively exploited. The failure occurs when the qede driver cannot allocate an SKB in qede_tpa_start() under memory pressure, causing an uninitialized data pointer to be used and leading to a kernel panic. The likely attack vector is the indirect induction of memory pressure or a denial‑of‑service scenario that forces low‑level allocation failure. At present, the vulnerability is considered an availability loss that would only affect systems running a version of the Linux kernel before commit 8a8633978b84. This CVE is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 7f911e208b3ca2c76d9f2bbba1f54b9403568c10
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 2a952fb1b20d83e83ca852773e6188511f7d2191
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< f5c8619ccbd70102642120c4c6fda1c048a555fd
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 06aa3d26327f24edd039ff249672fdf6f2ba5695

Linux

affected

Version	Status	Constraints
`4.18`	affected	—
`0`	unaffected	< 4.18
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,7f911e208b3ca2c76d9f2bbba1f54b9403568c10)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,2a952fb1b20d83e83ca852773e6188511f7d2191)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,f5c8619ccbd70102642120c4c6fda1c048a555fd)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,06aa3d26327f24edd039ff249672fdf6f2ba5695)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.18`	affected	semver	—
`[0,4.18)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that incorporates commit 8a8633978b84 or apply the patch directly to the kernel source.
Reboot the affected machines to load the updated kernel and driver.
Monitor system logs for remaining kernel panics related to qede and confirm that the issue no longer recurs.

Generated by OpenCVE AI on September 13, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695
https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191
https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10
https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd
https://nvd.nist.gov/vuln/detail/CVE-2026-89511
https://www.cve.org/CVERecord?id=CVE-2026-89511

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89511 https://www.cve.org/CVERecord?id=CVE-2026-89511
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 ("qede: Add build_skb() support.") accidentally dropped the assignment of tpa_info->buffer.data in qede_tpa_start(). When memory pressure causes an SKB allocation failure in qede_tpa_start(), the driver sets tpa_start_fail = true and attempts to recycle the physical page later in qede_tpa_end() via qede_reuse_page(). However, because buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a "ghost" BD (valid DMA mapping but NULL data pointer) back into the active Rx ring. The next time the hardware uses this ring slot, it passes a NULL page to qede_fill_frag_skb(), causing a kernel panic. Example crash from production system: BUG: unable to handle kernel NULL pointer dereference at 0x8 RIP: qede_fill_frag_skb+0x96/0x430 [qede] Call Trace: qede_rx_int+0xb06/0x1de0 qede_poll+0x2f4/0x6c0 __napi_poll+0x2d/0x130 Fix the root cause by restoring the tpa_info->buffer.data assignment in qede_tpa_start(), ensuring valid pages are correctly tracked and recycled. Additionally, update the stale comment for struct qede_agg_info::buffer to reflect its current usage.
Title		qede: Fix NULL pointer dereference in TPA fragment processing
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695 https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191 https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10 https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:56.640Z

Updated: 2026-09-13T06:30:16.019Z

Reserved: 2026-09-11T19:38:34.716Z

Link: CVE-2026-89511

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:33.513

Modified: 2026-09-13T07:17:14.073

Link: CVE-2026-89511

Redhat

Severity : Important

Publid Date: 2026-09-11T19:43:56Z

Links: CVE-2026-89511 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T08:00:13Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object