CVE-2026-89511

qede: Fix NULL pointer dereference in TPA fragment processing

Published Sep 11, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

qede: Fix NULL pointer dereference in TPA fragment processing

Under memory pressure, the qede driver encounters NULL pointer
dereferences when processing TPA continuation fragments.

Commit 8a8633978b84 ("qede: Add build_skb() support.") accidentally
dropped the assignment of tpa_info->buffer.data in qede_tpa_start().

When memory pressure causes an SKB allocation failure in qede_tpa_start(),
the driver sets tpa_start_fail = true and attempts to recycle the physical
page later in qede_tpa_end() via qede_reuse_page(). However, because
buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a
"ghost" BD (valid DMA mapping but NULL data pointer) back into the
active Rx ring.

The next time the hardware uses this ring slot, it passes a NULL page
to qede_fill_frag_skb(), causing a kernel panic.

Example crash from production system:
BUG: unable to handle kernel NULL pointer dereference at 0x8
RIP: qede_fill_frag_skb+0x96/0x430 [qede]
Call Trace:
qede_rx_int+0xb06/0x1de0
qede_poll+0x2f4/0x6c0
__napi_poll+0x2d/0x130

Fix the root cause by restoring the tpa_info->buffer.data assignment
in qede_tpa_start(), ensuring valid pages are correctly tracked and
recycled. Additionally, update the stale comment for
struct qede_agg_info::buffer to reflect its current usage.

Analysis

Technical impact

The qede driver in the Linux kernel contains a null pointer dereference that is triggered during TPA fragment processing when memory pressure causes an SKB allocation to fail. This flaw results in an uninitialized data pointer, leading to a kernel panic and loss of availability.

Affected Systems

All Linux kernel versions that include the qede driver are affected until the fix commit 8a8633978b84 is applied. No specific version list is provided, so any kernel where the qede driver is present is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, while the EPSS score of <1% signals a very low probability that this flaw will be actively exploited. The failure occurs when the qede driver cannot allocate an SKB in qede_tpa_start() under memory pressure, causing an uninitialized data pointer to be used and leading to a kernel panic the indirect induction of memory pressure or a denial-of-service scenario that forces low-level allocation failure. At present, the vulnerability is considered an availability loss that would only affect systems running a version of the Linux kernel before commit 8a8633978b84. This CVE is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< e2214e2793154b745436e46c6a9a7985d9b3781d
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< dd8bc0a9d87d2b048711edd17ba7286432edd285
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< fa7c9bd2c4a8de167e2fb32968ca4d91dd774375
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< a5e1fdc126ab337d601d1a00cc4b47910679d005
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 7f911e208b3ca2c76d9f2bbba1f54b9403568c10
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 2a952fb1b20d83e83ca852773e6188511f7d2191
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< f5c8619ccbd70102642120c4c6fda1c048a555fd
`8a8633978b842c88fbcfe00d4e5dde96048f630e`	affected	< 06aa3d26327f24edd039ff249672fdf6f2ba5695

Linux

affected

Version	Status	Constraints
`4.18`	affected	—
`0`	unaffected	< 4.18
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,7f911e208b3ca2c76d9f2bbba1f54b9403568c10)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,2a952fb1b20d83e83ca852773e6188511f7d2191)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,f5c8619ccbd70102642120c4c6fda1c048a555fd)`	affected	code_commit	—
`[8a8633978b842c88fbcfe00d4e5dde96048f630e,06aa3d26327f24edd039ff249672fdf6f2ba5695)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.18`	affected	semver	—
`[0,4.18)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that incorporates commit 8a8633978b84 or apply the patch directly to the kernel source.
Reboot the affected machines to load the updated kernel and driver.
Monitor system logs for remaining kernel panics related to qede and confirm that the issue no longer recurs.

Generated by OpenCVE AI on September 15, 2026 at 22:23 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.707% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695
https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191
https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10
https://git.kernel.org/stable/c/a5e1fdc126ab337d601d1a00cc4b47910679d005
https://git.kernel.org/stable/c/dd8bc0a9d87d2b048711edd17ba7286432edd285
https://git.kernel.org/stable/c/e2214e2793154b745436e46c6a9a7985d9b3781d
https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd
https://git.kernel.org/stable/c/fa7c9bd2c4a8de167e2fb32968ca4d91dd774375
https://nvd.nist.gov/vuln/detail/CVE-2026-89511
https://www.cve.org/CVERecord?id=CVE-2026-89511

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/a5e1fdc126ab337d601d1a00cc4b47910679d005 https://git.kernel.org/stable/c/dd8bc0a9d87d2b048711edd17ba7286432edd285 https://git.kernel.org/stable/c/e2214e2793154b745436e46c6a9a7985d9b3781d https://git.kernel.org/stable/c/fa7c9bd2c4a8de167e2fb32968ca4d91dd774375

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89511 https://www.cve.org/CVERecord?id=CVE-2026-89511
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 ("qede: Add build_skb() support.") accidentally dropped the assignment of tpa_info->buffer.data in qede_tpa_start(). When memory pressure causes an SKB allocation failure in qede_tpa_start(), the driver sets tpa_start_fail = true and attempts to recycle the physical page later in qede_tpa_end() via qede_reuse_page(). However, because buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a "ghost" BD (valid DMA mapping but NULL data pointer) back into the active Rx ring. The next time the hardware uses this ring slot, it passes a NULL page to qede_fill_frag_skb(), causing a kernel panic. Example crash from production system: BUG: unable to handle kernel NULL pointer dereference at 0x8 RIP: qede_fill_frag_skb+0x96/0x430 [qede] Call Trace: qede_rx_int+0xb06/0x1de0 qede_poll+0x2f4/0x6c0 __napi_poll+0x2d/0x130 Fix the root cause by restoring the tpa_info->buffer.data assignment in qede_tpa_start(), ensuring valid pages are correctly tracked and recycled. Additionally, update the stale comment for struct qede_agg_info::buffer to reflect its current usage.
Title		qede: Fix NULL pointer dereference in TPA fragment processing
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695 https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191 https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10 https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd