CVE-2026-89511

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

qede: Fix NULL pointer dereference in TPA fragment processing

Under memory pressure, the qede driver encounters NULL pointer

dereferences when processing TPA continuation fragments.

Commit 8a8633978b84 ("qede: Add build_skb() support.") accidentally

dropped the assignment of tpa_info->buffer.data in qede_tpa_start().

When memory pressure causes an SKB allocation failure in qede_tpa_start(),

the driver sets tpa_start_fail = true and attempts to recycle the physical

page later in qede_tpa_end() via qede_reuse_page(). However, because

buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a

"ghost" BD (valid DMA mapping but NULL data pointer) back into the

active Rx ring.

The next time the hardware uses this ring slot, it passes a NULL page

to qede_fill_frag_skb(), causing a kernel panic.

Example crash from production system:

BUG: unable to handle kernel NULL pointer dereference at 0x8

RIP: qede_fill_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References