---
id: CVE-2026-89511
title: 'qede: Fix NULL pointer dereference in TPA fragment processing'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  qede: Fix NULL pointer dereference in TPA fragment processing

  Under memory pressure, the qede driver encounters NULL pointer
  dereferences when processing TPA continuat…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-476
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e <
    e2214e2793154b745436e46c6a9a7985d9b3781d
  - >-
    Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e <
    dd8bc0a9d87d2b048711edd17ba7286432edd285
  - >-
    Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e <
    fa7c9bd2c4a8de167e2fb32968ca4d91dd774375
  - >-
    Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e <
    a5e1fdc126ab337d601d1a00cc4b47910679d005
  - >-
    Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e <
    7f911e208b3ca2c76d9f2bbba1f54b9403568c10
  - >-
    Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e <
    2a952fb1b20d83e83ca852773e6188511f7d2191
  - >-
    Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e <
    f5c8619ccbd70102642120c4c6fda1c048a555fd
  - >-
    Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e <
    06aa3d26327f24edd039ff249672fdf6f2ba5695
  - Linux 4.18
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T19:22:54.697925Z'
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:48:02.658Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89511'
references:
  - url: 'https://git.kernel.org/stable/c/e2214e2793154b745436e46c6a9a7985d9b3781d'
  - url: 'https://git.kernel.org/stable/c/dd8bc0a9d87d2b048711edd17ba7286432edd285'
  - url: 'https://git.kernel.org/stable/c/fa7c9bd2c4a8de167e2fb32968ca4d91dd774375'
  - url: 'https://git.kernel.org/stable/c/a5e1fdc126ab337d601d1a00cc4b47910679d005'
  - url: 'https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10'
  - url: 'https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191'
  - url: 'https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd'
  - url: 'https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89511.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89511'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532100'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89511'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89511'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89511.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00707
epssPercentile: 0.53234
scores:
  cna: 7.5
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.452Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

qede: Fix NULL pointer dereference in TPA fragment processing

Under memory pressure, the qede driver encounters NULL pointer
dereferences when processing TPA continuation fragments.

Commit 8a8633978b84 ("qede: Add build_skb() support.") accidentally
dropped the assignment of tpa_info->buffer.data in qede_tpa_start().

When memory pressure causes an SKB allocation failure in qede_tpa_start(),
the driver sets tpa_start_fail = true and attempts to recycle the physical
page later in qede_tpa_end() via qede_reuse_page(). However, because
buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a
"ghost" BD (valid DMA mapping but NULL data pointer) back into the
active Rx ring.

The next time the hardware uses this ring slot, it passes a NULL page
to qede_fill_frag_skb(), causing a kernel panic.

Example crash from production system:
 BUG: unable to handle kernel NULL pointer dereference at 0x8
 RIP: qede_fill_frag_skb+0x96/0x430 [qede]
 Call Trace:
   qede_rx_int+0xb06/0x1de0
   qede_poll+0x2f4/0x6c0
   __napi_poll+0x2d/0x130

Fix the root cause by restoring the tpa_info->buffer.data assignment
in qede_tpa_start(), ensuring valid pages are correctly tracked and
recycled. Additionally, update the stale comment for
struct qede_agg_info::buffer to reflect its current usage.

## Affected

- `Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e < e2214e2793154b745436e46c6a9a7985d9b3781d`
- `Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e < dd8bc0a9d87d2b048711edd17ba7286432edd285`
- `Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e < fa7c9bd2c4a8de167e2fb32968ca4d91dd774375`
- `Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e < a5e1fdc126ab337d601d1a00cc4b47910679d005`
- `Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e < 7f911e208b3ca2c76d9f2bbba1f54b9403568c10`
- `Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e < 2a952fb1b20d83e83ca852773e6188511f7d2191`
- `Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e < f5c8619ccbd70102642120c4c6fda1c048a555fd`
- `Linux >= 8a8633978b842c88fbcfe00d4e5dde96048f630e < 06aa3d26327f24edd039ff249672fdf6f2ba5695`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89511.json)