CVE-2026-72339

Status: UPDATED  |  Advisory ID: CVE-2026-72339

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

qede: fix off-by-one in BD ring consumption on build_skb failure

qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a

NULL return from qede_build_skb(). When it returns NULL under memory

pressure, the functions still consume a BD from the ring before

returning NULL. The callers then recycle additional BDs, resulting in

one extra BD being consumed (off-by-one). This desynchronizes the BD

ring, which can corrupt DMA page reference counts and lead to SLUB

freelist corruption.

Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")

added a NULL check inside qede_build_skb() to prevent a NULL pointer

dereference, but did not address the missing NULL checks in the

callers, making this off-by-one reachable.

Fix this by adding NULL checks for the return value of

qede_build_skb() in both qede_rx_build_skb() and

qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring

manipulation. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References