GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89511 (GCVE-0-2026-89511)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-14 12:00
VLAI
Title
qede: Fix NULL pointer dereference in TPA fragment processing
Summary
In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 ("qede: Add build_skb() support.") accidentally dropped the assignment of tpa_info->buffer.data in qede_tpa_start(). When memory pressure causes an SKB allocation failure in qede_tpa_start(), the driver sets tpa_start_fail = true and attempts to recycle the physical page later in qede_tpa_end() via qede_reuse_page(). However, because buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a "ghost" BD (valid DMA mapping but NULL data pointer) back into the active Rx ring. The next time the hardware uses this ring slot, it passes a NULL page to qede_fill_frag_skb(), causing a kernel panic. Example crash from production system: BUG: unable to handle kernel NULL pointer dereference at 0x8 RIP: qede_fill_frag_skb+0x96/0x430 [qede] Call Trace: qede_rx_int+0xb06/0x1de0 qede_poll+0x2f4/0x6c0 __napi_poll+0x2d/0x130 Fix the root cause by restoring the tpa_info->buffer.data assignment in qede_tpa_start(), ensuring valid pages are correctly tracked and recycled. Additionally, update the stale comment for struct qede_agg_info::buffer to reflect its current usage.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8a8633978b842c88fbcfe00d4e5dde96048f630e , < e2214e2793154b745436e46c6a9a7985d9b3781d (git)
Affected: 8a8633978b842c88fbcfe00d4e5dde96048f630e , < dd8bc0a9d87d2b048711edd17ba7286432edd285 (git)
Affected: 8a8633978b842c88fbcfe00d4e5dde96048f630e , < fa7c9bd2c4a8de167e2fb32968ca4d91dd774375 (git)
Affected: 8a8633978b842c88fbcfe00d4e5dde96048f630e , < a5e1fdc126ab337d601d1a00cc4b47910679d005 (git)
Affected: 8a8633978b842c88fbcfe00d4e5dde96048f630e , < 7f911e208b3ca2c76d9f2bbba1f54b9403568c10 (git)
Affected: 8a8633978b842c88fbcfe00d4e5dde96048f630e , < 2a952fb1b20d83e83ca852773e6188511f7d2191 (git)
Affected: 8a8633978b842c88fbcfe00d4e5dde96048f630e , < f5c8619ccbd70102642120c4c6fda1c048a555fd (git)
Affected: 8a8633978b842c88fbcfe00d4e5dde96048f630e , < 06aa3d26327f24edd039ff249672fdf6f2ba5695 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/qlogic/qede/qede.h",
            "drivers/net/ethernet/qlogic/qede/qede_fp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e2214e2793154b745436e46c6a9a7985d9b3781d",
              "status": "affected",
              "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
              "versionType": "git"
            },
            {
              "lessThan": "dd8bc0a9d87d2b048711edd17ba7286432edd285",
              "status": "affected",
              "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
              "versionType": "git"
            },
            {
              "lessThan": "fa7c9bd2c4a8de167e2fb32968ca4d91dd774375",
              "status": "affected",
              "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
              "versionType": "git"
            },
            {
              "lessThan": "a5e1fdc126ab337d601d1a00cc4b47910679d005",
              "status": "affected",
              "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
              "versionType": "git"
            },
            {
              "lessThan": "7f911e208b3ca2c76d9f2bbba1f54b9403568c10",
              "status": "affected",
              "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
              "versionType": "git"
            },
            {
              "lessThan": "2a952fb1b20d83e83ca852773e6188511f7d2191",
              "status": "affected",
              "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
              "versionType": "git"
            },
            {
              "lessThan": "f5c8619ccbd70102642120c4c6fda1c048a555fd",
              "status": "affected",
              "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
              "versionType": "git"
            },
            {
              "lessThan": "06aa3d26327f24edd039ff249672fdf6f2ba5695",
              "status": "affected",
              "version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/qlogic/qede/qede.h",
            "drivers/net/ethernet/qlogic/qede/qede_fp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: Fix NULL pointer dereference in TPA fragment processing\n\nUnder memory pressure, the qede driver encounters NULL pointer\ndereferences when processing TPA continuation fragments.\n\nCommit 8a8633978b84 (\"qede: Add build_skb() support.\") accidentally\ndropped the assignment of tpa_info-\u003ebuffer.data in qede_tpa_start().\n\nWhen memory pressure causes an SKB allocation failure in qede_tpa_start(),\nthe driver sets tpa_start_fail = true and attempts to recycle the physical\npage later in qede_tpa_end() via qede_reuse_page(). However, because\nbuffer.data was left uninitialized (NULL), qede_reuse_page() pushes a\n\"ghost\" BD (valid DMA mapping but NULL data pointer) back into the\nactive Rx ring.\n\nThe next time the hardware uses this ring slot, it passes a NULL page\nto qede_fill_frag_skb(), causing a kernel panic.\n\nExample crash from production system:\n BUG: unable to handle kernel NULL pointer dereference at 0x8\n RIP: qede_fill_frag_skb+0x96/0x430 [qede]\n Call Trace:\n   qede_rx_int+0xb06/0x1de0\n   qede_poll+0x2f4/0x6c0\n   __napi_poll+0x2d/0x130\n\nFix the root cause by restoring the tpa_info-\u003ebuffer.data assignment\nin qede_tpa_start(), ensuring valid pages are correctly tracked and\nrecycled. Additionally, update the stale comment for\nstruct qede_agg_info::buffer to reflect its current usage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in qede TPA/GRO RX on Marvell/QLogic FastLinQ NICs used on internet-facing datacenter and cloud servers. Remote TCP segments cause firmware to post TPA CQEs handled by qede_msix_fp_int()-\u003eqede_poll()-\u003eqede_rx_int()-\u003eqede_rx_process_tpa_cqe()-\u003eqede_tpa_start()/qede_tpa_end()/qede_fill_frag_skb().\nAC:L - An attacker can send high-rate TCP streams that HW GRO (enabled by default) aggregates and flood GFP_ATOMIC skb allocations until qede_tpa_start() fails, then keep sending so the recycled ghost BD is consumed. No uncontrolled race or victim-specific layout is required; the attacker drives TPA and the allocation-failure condition.\nPR:N - NIC receive and TPA completion handling run in softirq on inbound frames with no authentication, capability check, or local account. Any unauthenticated remote host that can send Ethernet/TCP traffic to a qede interface can reach the vulnerable path.\nUI:N - Packet reception, MSI-X interrupt handling, and NAPI polling process attacker frames automatically whenever the qede interface is up. The victim need not mount a filesystem, open a device, or otherwise interact.\nS:U - The NULL dereference oops stays in the host kernel that owns the qede driver and RX rings. It does not cross a VM, IOMMU, container, or other security-authority boundary.\nC:N - The fault is a pure NULL page-pointer dereference in qede_fill_frag_skb() (production RIP at offset 0x8) when a recycled ghost BD with buffer.data==NULL is consumed. There is no use-after-free reclaim, out-of-bounds read, or other disclosure primitive.\nI:N - skb_fill_page_desc()/page_ref_inc() abort immediately on the NULL page pointer without writing attacker-controlled data into other kernel objects, so there is no arbitrary-write or control-flow hijack primitive.\nA:H - The documented production crash is a kernel NULL pointer dereference panic in NAPI/softirq context (qede_fill_frag_skb), which is a complete availability impact under kernel CVSS guidance and can be retriggered by further traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:37.472Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e2214e2793154b745436e46c6a9a7985d9b3781d"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd8bc0a9d87d2b048711edd17ba7286432edd285"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa7c9bd2c4a8de167e2fb32968ca4d91dd774375"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5e1fdc126ab337d601d1a00cc4b47910679d005"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695"
        }
      ],
      "title": "qede: Fix NULL pointer dereference in TPA fragment processing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89511",
    "datePublished": "2026-09-11T19:43:56.640Z",
    "dateReserved": "2026-09-11T19:38:34.716Z",
    "dateUpdated": "2026-09-14T12:00:37.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89511",
      "date": "2026-09-17",
      "epss": "0.00716",
      "percentile": "0.52141"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89511\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:33.513\",\"lastModified\":\"2026-09-14T13:19:07.687\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nqede: Fix NULL pointer dereference in TPA fragment processing\\n\\nUnder memory pressure, the qede driver encounters NULL pointer\\ndereferences when processing TPA continuation fragments.\\n\\nCommit 8a8633978b84 (\\\"qede: Add build_skb() support.\\\") accidentally\\ndropped the assignment of tpa_info-\u003ebuffer.data in qede_tpa_start().\\n\\nWhen memory pressure causes an SKB allocation failure in qede_tpa_start(),\\nthe driver sets tpa_start_fail = true and attempts to recycle the physical\\npage later in qede_tpa_end() via qede_reuse_page(). However, because\\nbuffer.data was left uninitialized (NULL), qede_reuse_page() pushes a\\n\\\"ghost\\\" BD (valid DMA mapping but NULL data pointer) back into the\\nactive Rx ring.\\n\\nThe next time the hardware uses this ring slot, it passes a NULL page\\nto qede_fill_frag_skb(), causing a kernel panic.\\n\\nExample crash from production system:\\n BUG: unable to handle kernel NULL pointer dereference at 0x8\\n RIP: qede_fill_frag_skb+0x96/0x430 [qede]\\n Call Trace:\\n   qede_rx_int+0xb06/0x1de0\\n   qede_poll+0x2f4/0x6c0\\n   __napi_poll+0x2d/0x130\\n\\nFix the root cause by restoring the tpa_info-\u003ebuffer.data assignment\\nin qede_tpa_start(), ensuring valid pages are correctly tracked and\\nrecycled. Additionally, update the stale comment for\\nstruct qede_agg_info::buffer to reflect its current usage.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/qlogic/qede/qede.h\",\"drivers/net/ethernet/qlogic/qede/qede_fp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8a8633978b842c88fbcfe00d4e5dde96048f630e\",\"lessThan\":\"e2214e2793154b745436e46c6a9a7985d9b3781d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a8633978b842c88fbcfe00d4e5dde96048f630e\",\"lessThan\":\"dd8bc0a9d87d2b048711edd17ba7286432edd285\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a8633978b842c88fbcfe00d4e5dde96048f630e\",\"lessThan\":\"fa7c9bd2c4a8de167e2fb32968ca4d91dd774375\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a8633978b842c88fbcfe00d4e5dde96048f630e\",\"lessThan\":\"a5e1fdc126ab337d601d1a00cc4b47910679d005\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a8633978b842c88fbcfe00d4e5dde96048f630e\",\"lessThan\":\"7f911e208b3ca2c76d9f2bbba1f54b9403568c10\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a8633978b842c88fbcfe00d4e5dde96048f630e\",\"lessThan\":\"2a952fb1b20d83e83ca852773e6188511f7d2191\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a8633978b842c88fbcfe00d4e5dde96048f630e\",\"lessThan\":\"f5c8619ccbd70102642120c4c6fda1c048a555fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a8633978b842c88fbcfe00d4e5dde96048f630e\",\"lessThan\":\"06aa3d26327f24edd039ff249672fdf6f2ba5695\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/qlogic/qede/qede.h\",\"drivers/net/ethernet/qlogic/qede/qede_fp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06aa3d26327f24edd039ff249672fdf6f2ba5695\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2a952fb1b20d83e83ca852773e6188511f7d2191\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7f911e208b3ca2c76d9f2bbba1f54b9403568c10\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a5e1fdc126ab337d601d1a00cc4b47910679d005\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dd8bc0a9d87d2b048711edd17ba7286432edd285\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e2214e2793154b745436e46c6a9a7985d9b3781d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f5c8619ccbd70102642120c4c6fda1c048a555fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa7c9bd2c4a8de167e2fb32968ca4d91dd774375\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:49:44+00:00",
      "cve": "CVE-2026-89511",
      "id": "CVE-2026-89511",
      "initial_release_date": "2026-09-11T19:43:56.640000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux Kernel qede driver: Kernel panic due to NULL pointer dereference",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89511.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:02:33Z",
      "cve": "CVE-2026-89511",
      "id": "CVE-2026-89511",
      "initial_release_date": "2026-09-12T16:27:13Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89511",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89511.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.