Executive brief
The qede network driver contains a logic error in how it handles memory allocation failures when processing incoming network packets. When memory pressure causes the packet buffer allocation to fail, the driver incorrectly consumes one extra buffer descriptor from its ring, desynchronizing the hardware and software state. This can corrupt memory management structures and cause system instability or crashes.
Technical details
The vulnerability is an off-by-one error in the BD (Buffer Descriptor) ring consumption logic within the qede Ethernet driver (qede_rx_build_skb and qede_tpa_rx_build_skb functions). When qede_build_skb() returns NULL due to memory allocation failure, the caller functions still increment the BD ring pointer before returning NULL, while the caller's error handler also advances the ring. This double-consumption desynchronizes the BD ring and corrupts DMA page reference counts, leading to SLUB freelist corruption. The vulnerability is reachable under memory pressure and requires no special privileges or network access—a local denial-of-service or system corruption can be triggered. The fix adds NULL checks in both caller functions to return immediately before manipulating the BD ring, and patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions (qede driver affected since introduction of build_skb support)
Timeline
- 2026-08-15: disclosed: CVE-2026-72339 published
- 2026-07-24: patched: Fix committed to Linux kernel stable tree by Greg Kroah-Hartman
- 2026-07-01: other: Fix authored by Shigeru Yoshida