CVE-2026-72339

A flaw was found in the Linux kernel's qede component, which handles network device operations. Under specific memory pressure conditions, an error in how network buffer descriptors (BDs) are managed can lead to an off-by-one issue. This desynchronizes the BD ring, potentially corrupting memory and causing system instability or a denial of service.

Red Hat has evaluated this vulnerability as having a security impact of Important because memory corruption involving DMA page reference counts and SLUB freelists can lead to system crashes or potential privilege escalation. The issue is restricted to systems utilizing the qede network driver for QLogic FastLinQ Ethernet adapters under conditions of low memory availability. Environments that do not have this physical hardware installed or where the driver module is not loaded are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the qede kernel module from loading by creating a configuration file in /etc/modprobe.d/:

1. Disable loading of the module:

echo "install qede /bin/true" > /etc/modprobe.d/disable-qede.conf

2. If the driver is currently loaded, unload it:

modprobe -r qede

Warning: Disabling this module prevents the kernel from driving QLogic FastLinQ Ethernet adapters, which will terminate active network connections and disable those physical interfaces. If the module cannot be unloaded immediately, a system reboot will be required for the change to take effect.