CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure
In the Linux kernel, the following vulnerability has been resolved:
qede: fix off-by-one in BD ring consumption on buildskb failure
qederxbuildskb() and qedetparxbuildskb() do not check for a NULL return from qedebuildskb(). When it returns NULL under memory pressure, the functions still consume a BD from the ring before returning NULL. The callers then recycle additional BDs, resulting in one extra BD being consumed (off-by-one). This desynchronizes the BD ring, which can corrupt DMA page reference counts and lead to SLUB freelist corruption.
Commit 4e910dbe3650 ("qede: confirm skb is allocated before using") added a NULL check inside qedebuildskb() to prevent a NULL pointer dereference, but did not address the missing NULL checks in the callers, making this off-by-one reachable.
Fix this by adding NULL checks for the return value of qedebuildskb() in both qederxbuildskb() and qedetparxbuildskb(), returning NULL immediately before any BD ring manipulation.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (qede driver)to a version that resolves this vulnerability.Patch 4e910dbe3650 - Configuration
In qede_rx_build_skb() and qede_tpa_rx_build_skb(), check the return value of qede_build_skb() and if it returns NULL, return NULL immediately before any BD ring consumption/recycling to prevent BD ring consumption off-by-one and freelist corruption.
qede driver NULL checks for qede_build_skb() return value in qede_rx_build_skb() and qede_tpa_rx_build_skb() = Add NULL checks and return NULL immediately before consuming BD(s) from the ring