CVE-2026-72339

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

qede: fix off-by-one in BD ring consumption on build_skb failure

qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a

NULL return from qede_build_skb(). When it returns NULL under memory

pressure, the functions still consume a BD from the ring before

returning NULL. The callers then recycle additional BDs, resulting in

one extra BD being consumed (off-by-one). This desynchronizes the BD

ring, which can corrupt DMA page reference counts and lead to SLUB

freelist corruption.

Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")

added a NULL check inside qede_build_skb() to prevent a NULL pointer

dereference, but did not address the missing NULL checks in the

callers, making this off-by-one reachable.

Fix this by adding NULL checks for the return value of

qede_build_skb() in both qede_rx_build_skb() and

qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring

manipulation.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References