Executive brief
The qede network driver in the Linux kernel can crash with a NULL pointer dereference when handling received network packets under memory pressure. This occurs during TCP packet aggregation (TPA) fragment processing when memory allocation fails, leaving the driver with invalid page references that trigger kernel panics and service interruption.
Technical details
A missing variable assignment in the qede_tpa_start() function leaves the tpa_info->buffer.data pointer uninitialized (NULL). When an SKB allocation fails under memory pressure, the driver attempts to recycle the physical page via qede_reuse_page(), which pushes an invalid descriptor (valid DMA mapping but NULL data pointer) back into the Rx ring. When the hardware reuses this ring slot, qede_fill_frag_skb() receives a NULL page and dereferences it at offset 0x8, causing a kernel panic. The vulnerability requires local network access (receiving packets) and memory pressure conditions. The fix restores the missing tpa_info->buffer.data assignment in qede_tpa_start(), ensuring correct page tracking and recycling.
Affected products
- Linux Linux kernel Affected versions include kernels from 2.6.11 through 6.9+; introduced by commit 8a8633978b84
Timeline
- 2026-09-11: disclosed
- 2026-08-22: patched: Upstream fix committed by Jakub Kicinski
- 2026-09-07: other: Backported to stable by Greg Kroah-Hartman