CVE-2026-72339 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
qede: fix off-by-one in BD ring consumption on build_skb failure
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(). When it returns NULL under memory pressure, the functions still consume a BD from the ring before returning NULL. The callers then recycle additional BDs, resulting in one extra BD being consumed (off-by-one). This desynchronizes the BD ring, which can corrupt DMA page reference counts and lead to SLUB freelist corruption.
Commit 4e910dbe3650 ("qede: confirm skb is allocated before using") added a NULL check inside qede_build_skb() to prevent a NULL pointer dereference, but did not address the missing NULL checks in the callers, making this off-by-one reachable.
Fix this by adding NULL checks for the return value of qede_build_skb() in both qede_rx_build_skb() and qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring manipulation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical memory management flaw within the qede network driver of the Linux kernel, specifically affecting the handling of buffer descriptors during packet processing operations. This issue manifests as an off-by-one error in the consumption of buffer descriptor (BD) rings when the build_skb function fails to allocate memory under pressure conditions. The root cause stems from inadequate NULL pointer validation in two key functions: qede_rx_build_skb() and qede_tpa_rx_build_skb(), which fail to check for NULL returns from their underlying qede_build_skb() call.
The technical implementation flaw occurs when memory pressure forces qede_build_skb() to return NULL, yet the calling functions proceed to consume BD entries from the ring before performing the necessary NULL check. This premature consumption creates a synchronization mismatch between the actual buffer descriptor state and the driver's internal tracking mechanism. According to CWE-129, this represents an implementation error where insufficient validation leads to improper handling of boundary conditions during memory allocation failures.
The operational impact of this vulnerability extends beyond simple resource waste to potentially catastrophic system instability. When one extra BD is consumed due to the off-by-one error, it disrupts the DMA page reference counting mechanism that maintains proper memory management for network packet processing. This desynchronization directly leads to SLUB freelist corruption, where the kernel's slab allocator loses track of allocated memory blocks. Such corruption can manifest as kernel panics, system crashes, or more insidiously, data corruption that persists silently until discovered during subsequent operations.
The vulnerability is particularly concerning from a security perspective as it represents a potential denial-of-service vector that could be exploited by remote attackers to destabilize network services running on affected systems. Under sustained memory pressure conditions, an attacker could repeatedly trigger the race condition, eventually exhausting available network buffers and causing system instability. The fix addresses this through proper input validation by adding NULL checks for qede_build_skb() return values in both affected functions, ensuring immediate NULL return before any BD ring manipulation occurs. This approach aligns with ATT&CK technique T1499.004, which covers network disruption attacks targeting system resources.
The fix demonstrates adherence to defensive programming principles that prevent resource management errors in kernel space operations. By ensuring that the calling functions validate the return value before performing any ring consumption operations, the vulnerability becomes effectively mitigated. The solution directly addresses the missing null check issue introduced in commit 4e910dbe3650, which added protection within qede_build_skb() itself but failed to account for the caller-side validation requirements. This remediation strategy prevents the propagation of error states from lower-level functions to higher-level resource management components, maintaining the integrity of the kernel's memory allocation subsystem and ensuring proper synchronization between hardware buffer states and software tracking mechanisms.