CVE-2026-89511qede: Fix NULL pointer dereference in TPA fragment processing
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 ("qede: Add build_skb() support.") accidentally dropped the assignment of tpa_info->buffer.data in qede_tpa_start(). When memory pressure causes an SKB allocation failure in qede_tpa_start(), the driver sets tpa_start_fail = true and attempts to recycle the physical page later in qede_tpa_end() via qede_reuse_page(). However, because buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a "ghost" BD (valid DMA mapping but NULL data pointer) back into the active Rx ring. The next time the hardware uses this ring slot, it passes a NULL page to qede_fill_frag_skb(), causing a kernel panic. Example crash from production system: BUG: unable to handle kernel NULL pointer dereference at 0x8 RIP: qede_fill_frag_skb+0x96/0x430 [qede] Call Trace: qede_rx_int+0xb06/0x1de0 qede_poll+0x2f4/0x6c0 __napi_poll+0x2d/0x130 Fix the root cause by restoring the tpa_info->buffer.data assignment in qede_tpa_start(), ensuring valid pages are correctly tracked and recycled. Additionally, update the stale comment for struct qede_agg_info::buffer to reflect its current usage.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8a8633978b842c88fbcfe00d4e5dde96048f630e before e2214e2793154b745436e46c6a9a7985d9b3781d; from 8a8633978b842c88fbcfe00d4e5dde96048f630e before dd8bc0a9d87d2b048711edd17ba7286432edd285; from 8a8633978b842c88fbcfe00d4e5dde96048f630e before fa7c9bd2c4a8de167e2fb32968ca4d91dd774375; from 8a8633978b842c88fbcfe00d4e5dde96048f630e before a5e1fdc126ab337d601d1a00cc4b47910679d005; 8a8633978b842c88fbcfe00d4e5dde96048f630e builds before 7f911e208b3ca2c76d9f2bbba1f54b9403568c10; 8a8633978b842c88fbcfe00d4e5dde96048f630e builds before 2a952fb1b20d83e83ca852773e6188511f7d2191; from 8a8633978b842c88fbcfe00d4e5dde96048f630e before f5c8619ccbd70102642120c4c6fda1c048a555fd; 8a8633978b842c88fbcfe00d4e5dde96048f630e builds before 06aa3d26327f24edd039ff249672fdf6f2ba5695 | CNA record |
References
- https://git.kernel.org/stable/c/e2214e2793154b745436e46c6a9a7985d9b3781d
- https://git.kernel.org/stable/c/dd8bc0a9d87d2b048711edd17ba7286432edd285
- https://git.kernel.org/stable/c/fa7c9bd2c4a8de167e2fb32968ca4d91dd774375
- https://git.kernel.org/stable/c/a5e1fdc126ab337d601d1a00cc4b47910679d005
- https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10
- https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191
- https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd
- https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.