{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-72339",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-72339"
  ],
  "published": "2026-08-15T06:04:33Z",
  "summary": "qede: fix off-by-one in BD ring consumption on build_skb failure",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: fix off-by-one in BD ring consumption on build_skb failure\n\nqede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a\nNULL return from qede_build_skb(). When it returns NULL under memory\npressure, the functions still consume a BD from the ring before\nreturning NULL. The callers then recycle additional BDs, resulting in\none extra BD being consumed (off-by-one). This desynchronizes the BD\nring, which can corrupt DMA page reference counts and lead to SLUB\nfreelist corruption.\n\nCommit 4e910dbe3650 (\"qede: confirm skb is allocated before using\")\nadded a NULL check inside qede_build_skb() to prevent a NULL pointer\ndereference, but did not address the missing NULL checks in the\ncallers, making this off-by-one reachable.\n\nFix this by adding NULL checks for the return value of\nqede_build_skb() in both qede_rx_build_skb() and\nqede_tpa_rx_build_skb(), returning NULL immediately before any BD ring\nmanipulation.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.178",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72339"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ecc05d4b20220a09c9c69584fc46ca55248a374a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/07be8b8adf91b7ada4c3dacce064d572a6066421"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1624aa100c0b218181aa74e3696a389b509298cb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0bf78df2d3ecb1f4964ff42a7327d25845955153"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/814a5edac8c9fc04051808d5faaa93768e989281"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b066420e57f3402a52c998678b4678252ac9bb63"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/982d6d6bc059c5dff37a2201c2f08c14bcfcbd20"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:50:24Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 9.8,
      "cvss_v3_severity": "Critical",
      "scenario": "AV:N - The bug is in the qede NIC RX fastpath reached when remote Ethernet frames are received, hardware posts completion queue entries, and NAPI runs qede_poll() -> qede_rx_int() -> qede_rx_process_cqe()/qede_tpa_start() into qede_rx_build_skb() or qede_tpa_rx_build_skb().\nAC:L - An attacker can reliably trigger build_skb() NULL returns by flooding the interface with frames larger than rx_copybreak (256 bytes) to exhaust GFP_ATOMIC skb slab allocations, then the off-by-one BD consumption desynchronizes the ring without races or victim-specific state.\nPR:N - No local account, capability, or authentication is required; any unauthenticated remote host that can send IP/Ethernet traffic to a server using a Marvell/QLogic FastLinQ qede NIC can hit the vulnerable RX/TPA handlers.\nUI:N - Exploitation requires no victim interaction beyond normal network operation; packet reception, MSI-X interrupt handling, and NAPI polling process attacker-supplied frames automatically in kernel context.\nS:U - The flaw corrupts kernel heap metadata (DMA page refcounts and SLUB freelists) within the host kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - BD ring desynchronization corrupts DMA page reference counts and can corrupt SLUB freelists; this class of kernel heap corruption is exploitable for arbitrary kernel memory reads and information disclosure beyond a simple crash.\nI:H - SLUB freelist corruption from mismatched BD ring consumption enables arbitrary kernel memory writes and control-flow hijacking primitives, supporting local privilege escalation or arbitrary code execution in kernel context.\nA:H - Reference-count and SLUB corruption from the desynchronized BD ring can cause kernel BUG/oops/panic or a wedged RX datapath, resulting in complete loss of host availability on affected systems."
    }
  }
}