CVE-2026-89511

A regression in the Linux kernel's qede driver (introduced by commit 8a8633978b84, 'qede: Add build_skb() support.') dropped the assignment of tpa_info->buffer.data in qede_tpa_start(). Under memory pressure, an SKB allocation failure causes the driver to mark the aggregation as failed and later recycle the page through qede_reuse_page(), which pushes a 'ghost' buffer descriptor — valid DMA mapping but NULL data pointer — back into the active Rx ring. When the hardware next uses that ring slot, qede_fill_frag_skb() dereferences the NULL page, producing a kernel panic (BUG: unable to handle kernel NULL pointer dereference in qede_fill_frag_skb), a denial of service with no confidentiality or integrity impact (CVSS 3.1: 7.5, A:H). Only systems using QLogic/Marvell qed-based Ethernet adapters handled by the qede driver, with TCP payload aggregation (TPA/LRO) active, are affected. No public proof of concept exists and the flaw is not in the CISA KEV catalog, though the description includes a crash observed on a production system, so it can occur naturally under memory pressure.

What to do: Apply a kernel update containing the fix (the restored tpa_info->buffer.data assignment in qede_tpa_start()) as soon as your distribution backports it, and check running hosts for qede devices (e.g., lspci showing QLogic/Marvell FastLinQ-class adapters). As an interim mitigation on affected systems, disable LRO on the qede interface (e.g., ethtool -K <iface> lro off) to bypass the TPA fragment path, and monitor dmesg for 'qede_fill_frag_skb' NULL pointer oopses, especially on memory-constrained hosts.