CVE-2026-89511

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89511", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.716Z", "datePublished": "2026-09-11T19:43:56.640Z", "dateUpdated": "2026-10-19T08:48:02.658Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:48:02.658Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: Fix NULL pointer dereference in TPA fragment processing\n\nUnder memory pressure, the qede driver encounters NULL pointer\ndereferences when processing TPA continuation fragments.\n\nCommit 8a8633978b84 (\"qede: Add build_skb() support.\") accidentally\ndropped the assignment of tpa_info->buffer.data in qede_tpa_start().\n\nWhen memory pressure causes an SKB allocation failure in qede_tpa_start(),\nthe driver sets tpa_start_fail = true and attempts to recycle the physical\npage later in qede_tpa_end() via qede_reuse_page(). However, because\nbuffer.data was left uninitialized (NULL), qede_reuse_page() pushes a\n\"ghost\" BD (valid DMA mapping but NULL data pointer) back into the\nactive Rx ring.\n\nThe next time the hardware uses this ring slot, it passes a NULL page\nto qede_fill_frag_skb(), causing a kernel panic.\n\nExample crash from production system:\n BUG: unable to handle kernel NULL pointer dereference at 0x8\n RIP: qede_fill_frag_skb+0x96/0x430 [qede]\n Call Trace:\n qede_rx_int+0xb06/0x1de0\n qede_poll+0x2f4/0x6c0\n __napi_poll+0x2d/0x130\n\nFix the root cause by restoring the tpa_info->buffer.data assignment\nin qede_tpa_start(), ensuring valid pages are correctly tracked and\nrecycled. Additionally, update the stale comment for\nstruct qede_agg_info::buffer to reflect its current usage."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in qede TPA/GRO RX on Marvell/QLogic FastLinQ NICs used on internet-facing datacenter and cloud servers. Remote TCP segments cause firmware to post TPA CQEs handled by qede_msix_fp_int()->qede_poll()->qede_rx_int()->qede_rx_process_tpa_cqe()->qede_tpa_start()/qede_tpa_end()/qede_fill_frag_skb().\nAC:L - An attacker can send high-rate TCP streams that HW GRO (enabled by default) aggregates and flood GFP_ATOMIC skb allocations until qede_tpa_start() fails, then keep sending so the recycled ghost BD is consumed. No uncontrolled race or victim-specific layout is required; the attacker drives TPA and the allocation-failure condition.\nPR:N - NIC receive and TPA completion handling run in softirq on inbound frames with no authentication, capability check, or local account. Any unauthenticated remote host that can send Ethernet/TCP traffic to a qede interface can reach the vulnerable path.\nUI:N - Packet reception, MSI-X interrupt handling, and NAPI polling process attacker frames automatically whenever the qede interface is up. The victim need not mount a filesystem, open a device, or otherwise interact.\nS:U - The NULL dereference oops stays in the host kernel that owns the qede driver and RX rings. It does not cross a VM, IOMMU, container, or other security-authority boundary.\nC:N - The fault is a pure NULL page-pointer dereference in qede_fill_frag_skb() (production RIP at offset 0x8) when a recycled ghost BD with buffer.data==NULL is consumed. There is no use-after-free reclaim, out-of-bounds read, or other disclosure primitive.\nI:N - skb_fill_page_desc()/page_ref_inc() abort immediately on the NULL page pointer without writing attacker-controlled data into other kernel objects, so there is no arbitrary-write or control-flow hijack primitive.\nA:H - The documented production crash is a kernel NULL pointer dereference panic in NAPI/softirq context (qede_fill_frag_skb), which is a complete availability impact under kernel CVSS guidance and can be retriggered by further traffic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede.h", "drivers/net/ethernet/qlogic/qede/qede_fp.c"], "versions": [{"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "e2214e2793154b745436e46c6a9a7985d9b3781d", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "dd8bc0a9d87d2b048711edd17ba7286432edd285", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "fa7c9bd2c4a8de167e2fb32968ca4d91dd774375", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "a5e1fdc126ab337d601d1a00cc4b47910679d005", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "7f911e208b3ca2c76d9f2bbba1f54b9403568c10", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "2a952fb1b20d83e83ca852773e6188511f7d2191", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "f5c8619ccbd70102642120c4c6fda1c048a555fd", "status": "affected", "versionType": "git"}, {"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "06aa3d26327f24edd039ff249672fdf6f2ba5695", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede.h", "drivers/net/ethernet/qlogic/qede/qede_fp.c"], "versions": [{"version": "4.18", "status": "affected"}, {"version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e2214e2793154b745436e46c6a9a7985d9b3781d"}, {"url": "https://git.kernel.org/stable/c/dd8bc0a9d87d2b048711edd17ba7286432edd285"}, {"url": "https://git.kernel.org/stable/c/fa7c9bd2c4a8de167e2fb32968ca4d91dd774375"}, {"url": "https://git.kernel.org/stable/c/a5e1fdc126ab337d601d1a00cc4b47910679d005"}, {"url": "https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10"}, {"url": "https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191"}, {"url": "https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd"}, {"url": "https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695"}], "title": "qede: Fix NULL pointer dereference in TPA fragment processing", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89511", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:22:54.697925Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:40.664Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89511", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:22:54.697925Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:22:55.308Z"}}], "cna": {"title": "qede: Fix NULL pointer dereference in TPA fragment processing", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in qede TPA/GRO RX on Marvell/QLogic FastLinQ NICs used on internet-facing datacenter and cloud servers. Remote TCP segments cause firmware to post TPA CQEs handled by qede_msix_fp_int()->qede_poll()->qede_rx_int()->qede_rx_process_tpa_cqe()->qede_tpa_start()/qede_tpa_end()/qede_fill_frag_skb().\nAC:L - An attacker can send high-rate TCP streams that HW GRO (enabled by default) aggregates and flood GFP_ATOMIC skb allocations until qede_tpa_start() fails, then keep sending so the recycled ghost BD is consumed. No uncontrolled race or victim-specific layout is required; the attacker drives TPA and the allocation-failure condition.\nPR:N - NIC receive and TPA completion handling run in softirq on inbound frames with no authentication, capability check, or local account. Any unauthenticated remote host that can send Ethernet/TCP traffic to a qede interface can reach the vulnerable path.\nUI:N - Packet reception, MSI-X interrupt handling, and NAPI polling process attacker frames automatically whenever the qede interface is up. The victim need not mount a filesystem, open a device, or otherwise interact.\nS:U - The NULL dereference oops stays in the host kernel that owns the qede driver and RX rings. It does not cross a VM, IOMMU, container, or other security-authority boundary.\nC:N - The fault is a pure NULL page-pointer dereference in qede_fill_frag_skb() (production RIP at offset 0x8) when a recycled ghost BD with buffer.data==NULL is consumed. There is no use-after-free reclaim, out-of-bounds read, or other disclosure primitive.\nI:N - skb_fill_page_desc()/page_ref_inc() abort immediately on the NULL page pointer without writing attacker-controlled data into other kernel objects, so there is no arbitrary-write or control-flow hijack primitive.\nA:H - The documented production crash is a kernel NULL pointer dereference panic in NAPI/softirq context (qede_fill_frag_skb), which is a complete availability impact under kernel CVSS guidance and can be retriggered by further traffic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "e2214e2793154b745436e46c6a9a7985d9b3781d", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "dd8bc0a9d87d2b048711edd17ba7286432edd285", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "fa7c9bd2c4a8de167e2fb32968ca4d91dd774375", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "a5e1fdc126ab337d601d1a00cc4b47910679d005", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "7f911e208b3ca2c76d9f2bbba1f54b9403568c10", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "2a952fb1b20d83e83ca852773e6188511f7d2191", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "f5c8619ccbd70102642120c4c6fda1c048a555fd", "versionType": "git"}, {"status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "lessThan": "06aa3d26327f24edd039ff249672fdf6f2ba5695", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/qlogic/qede/qede.h", "drivers/net/ethernet/qlogic/qede/qede_fp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"status": "unaffected", "version": "0", "lessThan": "4.18", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.270", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.188", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.109", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.50", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/qlogic/qede/qede.h", "drivers/net/ethernet/qlogic/qede/qede_fp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e2214e2793154b745436e46c6a9a7985d9b3781d"}, {"url": "https://git.kernel.org/stable/c/dd8bc0a9d87d2b048711edd17ba7286432edd285"}, {"url": "https://git.kernel.org/stable/c/fa7c9bd2c4a8de167e2fb32968ca4d91dd774375"}, {"url": "https://git.kernel.org/stable/c/a5e1fdc126ab337d601d1a00cc4b47910679d005"}, {"url": "https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10"}, {"url": "https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191"}, {"url": "https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd"}, {"url": "https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: Fix NULL pointer dereference in TPA fragment processing\n\nUnder memory pressure, the qede driver encounters NULL pointer\ndereferences when processing TPA continuation fragments.\n\nCommit 8a8633978b84 (\"qede: Add build_skb() support.\") accidentally\ndropped the assignment of tpa_info->buffer.data in qede_tpa_start().\n\nWhen memory pressure causes an SKB allocation failure in qede_tpa_start(),\nthe driver sets tpa_start_fail = true and attempts to recycle the physical\npage later in qede_tpa_end() via qede_reuse_page(). However, because\nbuffer.data was left uninitialized (NULL), qede_reuse_page() pushes a\n\"ghost\" BD (valid DMA mapping but NULL data pointer) back into the\nactive Rx ring.\n\nThe next time the hardware uses this ring slot, it passes a NULL page\nto qede_fill_frag_skb(), causing a kernel panic.\n\nExample crash from production system:\n BUG: unable to handle kernel NULL pointer dereference at 0x8\n RIP: qede_fill_frag_skb+0x96/0x430 [qede]\n Call Trace:\n qede_rx_int+0xb06/0x1de0\n qede_poll+0x2f4/0x6c0\n __napi_poll+0x2d/0x130\n\nFix the root cause by restoring the tpa_info->buffer.data assignment\nin qede_tpa_start(), ensuring valid pages are correctly tracked and\nrecycled. Additionally, update the stale comment for\nstruct qede_agg_info::buffer to reflect its current usage."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.270", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.221", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.188", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.157", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.109", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.50", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2.4", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.3", "versionStartIncluding": "4.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:48:02.658Z"}}}, "cveMetadata": {"cveId": "CVE-2026-89511", "state": "PUBLISHED", "dateUpdated": "2026-10-19T08:48:02.658Z", "dateReserved": "2026-09-11T19:38:34.716Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-09-11T19:43:56.640Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede.h", "drivers/net/ethernet/qlogic/qede/qede_fp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e2214e2793154b745436e46c6a9a7985d9b3781d", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "dd8bc0a9d87d2b048711edd17ba7286432edd285", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "fa7c9bd2c4a8de167e2fb32968ca4d91dd774375", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "a5e1fdc126ab337d601d1a00cc4b47910679d005", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "7f911e208b3ca2c76d9f2bbba1f54b9403568c10", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "2a952fb1b20d83e83ca852773e6188511f7d2191", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "f5c8619ccbd70102642120c4c6fda1c048a555fd", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}, {"lessThan": "06aa3d26327f24edd039ff249672fdf6f2ba5695", "status": "affected", "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede.h", "drivers/net/ethernet/qlogic/qede/qede_fp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"lessThan": "4.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: Fix NULL pointer dereference in TPA fragment processing\n\nUnder memory pressure, the qede driver encounters NULL pointer\ndereferences when processing TPA continuation fragments.\n\nCommit 8a8633978b84 (\"qede: Add build_skb() support.\") accidentally\ndropped the assignment of tpa_info->buffer.data in qede_tpa_start().\n\nWhen memory pressure causes an SKB allocation failure in qede_tpa_start(),\nthe driver sets tpa_start_fail = true and attempts to recycle the physical\npage later in qede_tpa_end() via qede_reuse_page(). However, because\nbuffer.data was left uninitialized (NULL), qede_reuse_page() pushes a\n\"ghost\" BD (valid DMA mapping but NULL data pointer) back into the\nactive Rx ring.\n\nThe next time the hardware uses this ring slot, it passes a NULL page\nto qede_fill_frag_skb(), causing a kernel panic.\n\nExample crash from production system:\n BUG: unable to handle kernel NULL pointer dereference at 0x8\n RIP: qede_fill_frag_skb+0x96/0x430 [qede]\n Call Trace:\n qede_rx_int+0xb06/0x1de0\n qede_poll+0x2f4/0x6c0\n __napi_poll+0x2d/0x130\n\nFix the root cause by restoring the tpa_info->buffer.data assignment\nin qede_tpa_start(), ensuring valid pages are correctly tracked and\nrecycled. Additionally, update the stale comment for\nstruct qede_agg_info::buffer to reflect its current usage."}], "id": "CVE-2026-89511", "lastModified": "2026-10-19T09:17:45.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-89511", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:22:54.697925Z", "version": "2.0.3"}}]}, "published": "2026-09-11T20:19:33.513", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a5e1fdc126ab337d601d1a00cc4b47910679d005"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd8bc0a9d87d2b048711edd17ba7286432edd285"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2214e2793154b745436e46c6a9a7985d9b3781d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa7c9bd2c4a8de167e2fb32968ca4d91dd774375"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux Kernel qede driver: Kernel panic due to NULL pointer dereference", "id": "2532100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532100"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the qede driver in the Linux kernel. Under specific memory pressure conditions, the driver can encounter a NULL pointer dereference when processing network traffic using TPA (TCP Segmentation Offload) continuation fragments. This issue stems from an uninitialized data pointer, which can lead to the system attempting to use an invalid memory page. Consequently, this can trigger a kernel panic, causing a Denial of Service (DoS) for the affected system."], "name": "CVE-2026-89511", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:43:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89511\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89511\nhttps://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695\nhttps://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191\nhttps://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10\nhttps://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,7f911e208b3ca2c76d9f2bbba1f54b9403568c10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,2a952fb1b20d83e83ca852773e6188511f7d2191)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,f5c8619ccbd70102642120c4c6fda1c048a555fd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8a8633978b842c88fbcfe00d4e5dde96048f630e,06aa3d26327f24edd039ff249672fdf6f2ba5695)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T07:15:10.616172+00:00", "updated": "2026-09-15T22:30:15.264572+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}