CVE-2026-89511 Overview
CVE-2026-89511 is a NULL pointer dereference vulnerability in the Linux kernel's qede network driver, which supports QLogic FastLinQ 4xxxx Ethernet adapters. The flaw resides in the Transparent Packet Aggregation (TPA) fragment processing path. Under memory pressure, an SKB allocation failure leaves the tpa_info->buffer.data field uninitialized, causing the driver to recycle a buffer descriptor with a valid DMA mapping but a NULL data pointer. When hardware later uses that ring slot, qede_fill_frag_skb() dereferences the NULL page and triggers a kernel panic. The regression was introduced by commit 8a8633978b84 ("qede: Add build_skb() support.").
Critical Impact
Remote attackers can induce sustained memory pressure on affected systems to trigger repeatable kernel panics, resulting in denial of service on hosts using qede-managed network interfaces.
Affected Products
- Linux kernel versions containing commit 8a8633978b84 ("qede: Add build_skb() support.") through the fix
- Systems using QLogic FastLinQ 4xxxx (qede) Ethernet drivers
- Distributions shipping affected stable kernel branches prior to the patch commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89511 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89511
Vulnerability Analysis
The qede driver processes large received packets using TPA, a hardware-assisted large receive offload mechanism. In qede_tpa_start(), the driver allocates a socket buffer (SKB) to hold the aggregated packet. When the allocator fails under memory pressure, the driver sets tpa_start_fail = true and defers cleanup to qede_tpa_end(), which calls qede_reuse_page() to return the physical page to the Rx ring.
The regression left tpa_info->buffer.data uninitialized after the failed allocation. qede_reuse_page() therefore pushes a buffer descriptor with a valid DMA mapping but a NULL data field back into the active receive ring. The next hardware use of that slot passes the NULL page to qede_fill_frag_skb(), which dereferences it and panics the kernel with a fault at offset 0x8.
Root Cause
Commit 8a8633978b84 ("qede: Add build_skb() support.") inadvertently dropped the assignment of tpa_info->buffer.data in qede_tpa_start(). This left the tracking structure inconsistent whenever the SKB allocation path failed, producing a "ghost" buffer descriptor that the driver could not distinguish from a valid one during recycling [CWE-476].
Attack Vector
The attack vector is network-adjacent. An attacker who can sustain traffic that triggers TPA aggregation on the target interface, combined with conditions that induce SKB allocation failures, can force the panic path. Sustained high-throughput reception combined with memory pressure on the receiving host reproduces the crash observed in production traces, where the call chain runs through qede_rx_int and qede_poll inside the NAPI context.
No verified public exploit code is available. The vulnerability is described in prose because the fix consists of restoring a single field assignment; refer to the kernel commits listed under Patch Information for the exact change.
Detection Methods for CVE-2026-89511
Indicators of Compromise
- Kernel panic messages containing BUG: unable to handle kernel NULL pointer dereference at 0x8 with RIP: qede_fill_frag_skb+0x96/0x430 [qede] in the call trace.
- Repeated crash traces including qede_rx_int, qede_poll, and __napi_poll symbols on hosts using QLogic FastLinQ 4xxxx adapters.
- Unexpected reboots or NMI watchdog events on hosts under memory pressure that also serve high-throughput network workloads.
Detection Strategies
- Inventory Linux hosts running kernels between the introduction of commit 8a8633978b84 and the fix commits listed in the advisory, then correlate with presence of the qede module via lsmod.
- Ship kernel logs to a centralized log platform and alert on the specific panic signature and qede module symbols.
- Monitor NIC driver telemetry for elevated SKB allocation failures and TPA aggregation counters using ethtool -S <iface>.
Monitoring Recommendations
- Track host memory pressure metrics (PSI memory, MemAvailable, slab usage) on nodes with qede interfaces to identify preconditions for the crash.
- Enable kdump or equivalent crash capture so a triggering event yields a vmcore for triage.
- Alert on NIC link resets and unplanned reboots correlated with high Rx throughput windows.
How to Mitigate CVE-2026-89511
Immediate Actions Required
- Apply the stable kernel updates that include the fix commits referenced in the NVD advisory to every host running the qede driver.
- Prioritize patching on systems that terminate high-throughput network flows or run memory-constrained workloads alongside qede interfaces.
- Ensure kdump is configured so any residual crash produces a usable vmcore for engineering follow-up.
Patch Information
The fix restores the tpa_info->buffer.data assignment in qede_tpa_start() so that valid pages are tracked and recycled correctly. It also updates the stale comment for struct qede_agg_info::buffer. The change is available in the following upstream commits: Kernel Commit 06aa3d2, Kernel Commit 2a952fb1, Kernel Commit 7f911e20, Kernel Commit a5e1fdc1, Kernel Commit dd8bc0a9, Kernel Commit e2214e27, Kernel Commit f5c8619c, and Kernel Commit fa7c9bd2.
Workarounds
- Disable Generic Receive Offload and Large Receive Offload on affected interfaces to reduce reliance on TPA aggregation, for example: ethtool -K <iface> gro off lro off.
- Reduce host memory pressure by tuning workload placement, adjusting cgroup memory limits, or moving high-throughput ingress off memory-constrained nodes until the patch is deployed.
- If practical for the workload, migrate affected traffic to a non-qede NIC or bond configuration while patching is scheduled.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
