CVE-2026-72339

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72339", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.920Z", "datePublished": "2026-08-15T05:55:46.480Z", "dateUpdated": "2026-10-16T18:55:18.961Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:42:57.907Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: fix off-by-one in BD ring consumption on build_skb failure\n\nqede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a\nNULL return from qede_build_skb(). When it returns NULL under memory\npressure, the functions still consume a BD from the ring before\nreturning NULL. The callers then recycle additional BDs, resulting in\none extra BD being consumed (off-by-one). This desynchronizes the BD\nring, which can corrupt DMA page reference counts and lead to SLUB\nfreelist corruption.\n\nCommit 4e910dbe3650 (\"qede: confirm skb is allocated before using\")\nadded a NULL check inside qede_build_skb() to prevent a NULL pointer\ndereference, but did not address the missing NULL checks in the\ncallers, making this off-by-one reachable.\n\nFix this by adding NULL checks for the return value of\nqede_build_skb() in both qede_rx_build_skb() and\nqede_tpa_rx_build_skb(), returning NULL immediately before any BD ring\nmanipulation."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the qede NIC RX fastpath reached when remote Ethernet frames are received, hardware posts completion queue entries, and NAPI runs qede_poll() -> qede_rx_int() -> qede_rx_process_cqe()/qede_tpa_start() into qede_rx_build_skb() or qede_tpa_rx_build_skb().\nAC:L - An attacker can reliably trigger build_skb() NULL returns by flooding the interface with frames larger than rx_copybreak (256 bytes) to exhaust GFP_ATOMIC skb slab allocations, then the off-by-one BD consumption desynchronizes the ring without races or victim-specific state.\nPR:N - No local account, capability, or authentication is required; any unauthenticated remote host that can send IP/Ethernet traffic to a server using a Marvell/QLogic FastLinQ qede NIC can hit the vulnerable RX/TPA handlers.\nUI:N - Exploitation requires no victim interaction beyond normal network operation; packet reception, MSI-X interrupt handling, and NAPI polling process attacker-supplied frames automatically in kernel context.\nS:U - The flaw corrupts kernel heap metadata (DMA page refcounts and SLUB freelists) within the host kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - BD ring desynchronization corrupts DMA page reference counts and can corrupt SLUB freelists; this class of kernel heap corruption is exploitable for arbitrary kernel memory reads and information disclosure beyond a simple crash.\nI:H - SLUB freelist corruption from mismatched BD ring consumption enables arbitrary kernel memory writes and control-flow hijacking primitives, supporting local privilege escalation or arbitrary code execution in kernel context.\nA:H - Reference-count and SLUB corruption from the desynchronized BD ring can cause kernel BUG/oops/panic or a wedged RX datapath, resulting in complete loss of host availability on affected systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "versions": [{"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "ecc05d4b20220a09c9c69584fc46ca55248a374a", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "07be8b8adf91b7ada4c3dacce064d572a6066421", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "1624aa100c0b218181aa74e3696a389b509298cb", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "0bf78df2d3ecb1f4964ff42a7327d25845955153", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "814a5edac8c9fc04051808d5faaa93768e989281", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "b066420e57f3402a52c998678b4678252ac9bb63", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "982d6d6bc059c5dff37a2201c2f08c14bcfcbd20", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "versions": [{"version": "4.18", "status": "affected"}, {"version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ecc05d4b20220a09c9c69584fc46ca55248a374a"}, {"url": "https://git.kernel.org/stable/c/07be8b8adf91b7ada4c3dacce064d572a6066421"}, {"url": "https://git.kernel.org/stable/c/1624aa100c0b218181aa74e3696a389b509298cb"}, {"url": "https://git.kernel.org/stable/c/0bf78df2d3ecb1f4964ff42a7327d25845955153"}, {"url": "https://git.kernel.org/stable/c/814a5edac8c9fc04051808d5faaa93768e989281"}, {"url": "https://git.kernel.org/stable/c/b066420e57f3402a52c998678b4678252ac9bb63"}, {"url": "https://git.kernel.org/stable/c/982d6d6bc059c5dff37a2201c2f08c14bcfcbd20"}, {"url": "https://git.kernel.org/stable/c/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f"}], "title": "qede: fix off-by-one in BD ring consumption on build_skb failure", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72339", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:47:21.272710Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:18.961Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72339", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:47:21.272710Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:47:22.282Z"}}], "cna": {"title": "qede: fix off-by-one in BD ring consumption on build_skb failure", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the qede NIC RX fastpath reached when remote Ethernet frames are received, hardware posts completion queue entries, and NAPI runs qede_poll() -> qede_rx_int() -> qede_rx_process_cqe()/qede_tpa_start() into qede_rx_build_skb() or qede_tpa_rx_build_skb().\nAC:L - An attacker can reliably trigger build_skb() NULL returns by flooding the interface with frames larger than rx_copybreak (256 bytes) to exhaust GFP_ATOMIC skb slab allocations, then the off-by-one BD consumption desynchronizes the ring without races or victim-specific state.\nPR:N - No local account, capability, or authentication is required; any unauthenticated remote host that can send IP/Ethernet traffic to a server using a Marvell/QLogic FastLinQ qede NIC can hit the vulnerable RX/TPA handlers.\nUI:N - Exploitation requires no victim interaction beyond normal network operation; packet reception, MSI-X interrupt handling, and NAPI polling process attacker-supplied frames automatically in kernel context.\nS:U - The flaw corrupts kernel heap metadata (DMA page refcounts and SLUB freelists) within the host kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - BD ring desynchronization corrupts DMA page reference counts and can corrupt SLUB freelists; this class of kernel heap corruption is exploitable for arbitrary kernel memory reads and information disclosure beyond a simple crash.\nI:H - SLUB freelist corruption from mismatched BD ring consumption enables arbitrary kernel memory writes and control-flow hijacking primitives, supporting local privilege escalation or arbitrary code execution in kernel context.\nA:H - Reference-count and SLUB corruption from the desynchronized BD ring can cause kernel BUG/oops/panic or a wedged RX datapath, resulting in complete loss of host availability on affected systems."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "ecc05d4b20220a09c9c69584fc46ca55248a374a", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "07be8b8adf91b7ada4c3dacce064d572a6066421", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "1624aa100c0b218181aa74e3696a389b509298cb", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "0bf78df2d3ecb1f4964ff42a7327d25845955153", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "814a5edac8c9fc04051808d5faaa93768e989281", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "b066420e57f3402a52c998678b4678252ac9bb63", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "982d6d6bc059c5dff37a2201c2f08c14bcfcbd20", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"status": "unaffected", "version": "0", "lessThan": "4.18", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ecc05d4b20220a09c9c69584fc46ca55248a374a"}, {"url": "https://git.kernel.org/stable/c/07be8b8adf91b7ada4c3dacce064d572a6066421"}, {"url": "https://git.kernel.org/stable/c/1624aa100c0b218181aa74e3696a389b509298cb"}, {"url": "https://git.kernel.org/stable/c/0bf78df2d3ecb1f4964ff42a7327d25845955153"}, {"url": "https://git.kernel.org/stable/c/814a5edac8c9fc04051808d5faaa93768e989281"}, {"url": "https://git.kernel.org/stable/c/b066420e57f3402a52c998678b4678252ac9bb63"}, {"url": "https://git.kernel.org/stable/c/982d6d6bc059c5dff37a2201c2f08c14bcfcbd20"}, {"url": "https://git.kernel.org/stable/c/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: fix off-by-one in BD ring consumption on build_skb failure\n\nqede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a\nNULL return from qede_build_skb(). When it returns NULL under memory\npressure, the functions still consume a BD from the ring before\nreturning NULL. The callers then recycle additional BDs, resulting in\none extra BD being consumed (off-by-one). This desynchronizes the BD\nring, which can corrupt DMA page reference counts and lead to SLUB\nfreelist corruption.\n\nCommit 4e910dbe3650 (\"qede: confirm skb is allocated before using\")\nadded a NULL check inside qede_build_skb() to prevent a NULL pointer\ndereference, but did not address the missing NULL checks in the\ncallers, making this off-by-one reachable.\n\nFix this by adding NULL checks for the return value of\nqede_build_skb() in both qede_rx_build_skb() and\nqede_tpa_rx_build_skb(), returning NULL immediately before any BD ring\nmanipulation."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:42:57.907Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72339", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:18.961Z", "dateReserved": "2026-08-09T03:40:39.920Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:55:46.480Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ecc05d4b20220a09c9c69584fc46ca55248a374a", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "07be8b8adf91b7ada4c3dacce064d572a6066421", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "1624aa100c0b218181aa74e3696a389b509298cb", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "0bf78df2d3ecb1f4964ff42a7327d25845955153", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "814a5edac8c9fc04051808d5faaa93768e989281", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "b066420e57f3402a52c998678b4678252ac9bb63", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "982d6d6bc059c5dff37a2201c2f08c14bcfcbd20", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"lessThan": "4.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: fix off-by-one in BD ring consumption on build_skb failure\n\nqede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a\nNULL return from qede_build_skb(). When it returns NULL under memory\npressure, the functions still consume a BD from the ring before\nreturning NULL. The callers then recycle additional BDs, resulting in\none extra BD being consumed (off-by-one). This desynchronizes the BD\nring, which can corrupt DMA page reference counts and lead to SLUB\nfreelist corruption.\n\nCommit 4e910dbe3650 (\"qede: confirm skb is allocated before using\")\nadded a NULL check inside qede_build_skb() to prevent a NULL pointer\ndereference, but did not address the missing NULL checks in the\ncallers, making this off-by-one reachable.\n\nFix this by adding NULL checks for the return value of\nqede_build_skb() in both qede_rx_build_skb() and\nqede_tpa_rx_build_skb(), returning NULL immediately before any BD ring\nmanipulation."}], "id": "CVE-2026-72339", "lastModified": "2026-10-16T19:17:23.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72339", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:47:21.272710Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:07.150", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07be8b8adf91b7ada4c3dacce064d572a6066421"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0bf78df2d3ecb1f4964ff42a7327d25845955153"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1624aa100c0b218181aa74e3696a389b509298cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/814a5edac8c9fc04051808d5faaa93768e989281"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/982d6d6bc059c5dff37a2201c2f08c14bcfcbd20"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b066420e57f3402a52c998678b4678252ac9bb63"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ecc05d4b20220a09c9c69584fc46ca55248a374a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: qede: fix off-by-one in BD ring consumption on build_skb failure", "id": "2516456", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516456"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-193", "details": ["A flaw was found in the Linux kernel's qede component, which handles network device operations. Under specific memory pressure conditions, an error in how network buffer descriptors (BDs) are managed can lead to an off-by-one issue. This desynchronizes the BD ring, potentially corrupting memory and causing system instability or a denial of service."], "name": "CVE-2026-72339", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72339\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72339\nhttps://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-72339-ca7a@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,ecc05d4b20220a09c9c69584fc46ca55248a374a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,07be8b8adf91b7ada4c3dacce064d572a6066421)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,1624aa100c0b218181aa74e3696a389b509298cb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,0bf78df2d3ecb1f4964ff42a7327d25845955153)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,814a5edac8c9fc04051808d5faaa93768e989281)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe0\u00ad7e5dde96048f630e,b066420e57f3402a52c998678b4678252ac9bb63)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,982d6d6bc059c5dff37a2201c2f08c14bcfcbd20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T11:00:05.550494+00:00", "updated": "2026-08-22T10:15:04.755514+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}