{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89511", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.716Z", "datePublished": "2026-09-11T19:43:56.640Z", "dateUpdated": "2026-09-11T19:43:56.640Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:43:56.640Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: Fix NULL pointer dereference in TPA fragment processing\n\nUnder memory pressure, the qede driver encounters NULL pointer\ndereferences when processing TPA continuation fragments.\n\nCommit 8a8633978b84 (\"qede: Add build_skb() support.\") accidentally\ndropped the assignment of tpa_info->buffer.data in qede_tpa_start().\n\nWhen memory pressure causes an SKB allocation failure in qede_tpa_start(),\nthe driver sets tpa_start_fail = true and attempts to recycle the physical\npage later in qede_tpa_end() via qede_reuse_page(). However, because\nbuffer.data was left uninitialized (NULL), qede_reuse_page() pushes a\n\"ghost\" BD (valid DMA mapping but NULL data pointer) back into the\nactive Rx ring.\n\nThe next time the hardware uses this ring slot, it passes a NULL page\nto qede_fill_frag_skb(), causing a kernel panic.\n\nExample crash from production system:\n BUG: unable to handle kernel NULL pointer dereference at 0x8\n RIP: qede_fill_frag_skb+0x96/0x430 [qede]\n Call Trace:\n qede_rx_int+0xb06/0x1de0\n qede_poll+0x2f4/0x6c0\n __napi_poll+0x2d/0x130\n\nFix the root cause by restoring the tpa_info->buffer.data assignment\nin qede_tpa_start(), ensuring valid pages are correctly tracked and\nrecycled. Additionally, update the stale comment for\nstruct qede_agg_info::buffer to reflect its current usage."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede.h", "drivers/net/ethernet/qlogic/qede/qede_fp.c"], "versions": [{"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "7f911e208b3ca2c76d9f2bbba1f54b9403568c10", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "2a952fb1b20d83e83ca852773e6188511f7d2191", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "f5c8619ccbd70102642120c4c6fda1c048a555fd", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "06aa3d26327f24edd039ff249672fdf6f2ba5695", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede.h", "drivers/net/ethernet/qlogic/qede/qede_fp.c"], "versions": [{"version": "4.18", "status": "affected"}, {"version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10"}, {"url": "https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191"}, {"url": "https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd"}, {"url": "https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695"}], "title": "qede: Fix NULL pointer dereference in TPA fragment processing", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede.h", "drivers/net/ethernet/qlogic/qede/qede_fp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7f911e208b3ca2c76d9f2bbba1f54b9403568c10", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "2a952fb1b20d83e83ca852773e6188511f7d2191", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "f5c8619ccbd70102642120c4c6fda1c048a555fd", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "06aa3d26327f24edd039ff249672fdf6f2ba5695", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede.h", "drivers/net/ethernet/qlogic/qede/qede_fp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"lessThan": "4.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: Fix NULL pointer dereference in TPA fragment processing\n\nUnder memory pressure, the qede driver encounters NULL pointer\ndereferences when processing TPA continuation fragments.\n\nCommit 8a8633978b84 (\"qede: Add build_skb() support.\") accidentally\ndropped the assignment of tpa_info->buffer.data in qede_tpa_start().\n\nWhen memory pressure causes an SKB allocation failure in qede_tpa_start(),\nthe driver sets tpa_start_fail = true and attempts to recycle the physical\npage later in qede_tpa_end() via qede_reuse_page(). However, because\nbuffer.data was left uninitialized (NULL), qede_reuse_page() pushes a\n\"ghost\" BD (valid DMA mapping but NULL data pointer) back into the\nactive Rx ring.\n\nThe next time the hardware uses this ring slot, it passes a NULL page\nto qede_fill_frag_skb(), causing a kernel panic.\n\nExample crash from production system:\n BUG: unable to handle kernel NULL pointer dereference at 0x8\n RIP: qede_fill_frag_skb+0x96/0x430 [qede]\n Call Trace:\n qede_rx_int+0xb06/0x1de0\n qede_poll+0x2f4/0x6c0\n __napi_poll+0x2d/0x130\n\nFix the root cause by restoring the tpa_info->buffer.data assignment\nin qede_tpa_start(), ensuring valid pages are correctly tracked and\nrecycled. Additionally, update the stale comment for\nstruct qede_agg_info::buffer to reflect its current usage."}], "id": "CVE-2026-89511", "lastModified": "2026-09-11T20:19:33.513", "metrics": {}, "published": "2026-09-11T20:19:33.513", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux Kernel qede driver: Kernel panic due to NULL pointer dereference", "id": "2532100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532100"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the qede driver in the Linux kernel. Under specific memory pressure conditions, the driver can encounter a NULL pointer dereference when processing network traffic using TPA (TCP Segmentation Offload) continuation fragments. This issue stems from an uninitialized data pointer, which can lead to the system attempting to use an invalid memory page. Consequently, this can trigger a kernel panic, causing a Denial of Service (DoS) for the affected system."], "name": "CVE-2026-89511", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:43:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89511\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89511\nhttps://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695\nhttps://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191\nhttps://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10\nhttps://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd"], "threat_severity": "Important"}

{}