CVE-2026-72339

In the Linux kernel, the following vulnerability has been resolved:

qede: fix off-by-one in BD ring consumption on build_skb failure

qederxbuildskb() and qedetparxbuild_skb() do not check for a

NULL return from qedebuildskb(). When it returns NULL under memory

pressure, the functions still consume a BD from the ring before

returning NULL. The callers then recycle additional BDs, resulting in

one extra BD being consumed (off-by-one). This desynchronizes the BD

ring, which can corrupt DMA page reference counts and lead to SLUB

freelist corruption.

Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")

added a NULL check inside qedebuildskb() to prevent a NULL pointer

dereference, but did not address the missing NULL checks in the

callers, making this off-by-one reachable.

Fix this by adding NULL checks for the return value of

qedebuildskb() in both qederxbuild_skb() and

qedetparxbuildskb(), returning NULL immediately before any BD ring

manipulation.