CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
Vulnerability summary
CVE-2026-23386 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 2% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 23 · Related 21Timeline
- 25-03-2026PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL In DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA buffer cleanup path. It iterates num_bufs times and attempts to unmap entries in the dma array. This leads to two issues: 1. The dma array shares storage with tx_qpl_buf_ids (union). Interpreting buffer IDs as DMA addresses results in attempting to unmap incorrect memory locations. 2. num_bufs in QPL mode (counting 2K chunks) can significantly exceed the size of the dma array, causing out-of-bounds access warnings (trace below is how we noticed this issue). UBSAN: array-index-out-of-bounds in drivers/net/ethernet/drivers/net/ethernet/google/gve/gve_tx_dqo.c:178:5 index 18 is out of range for type 'dma_addr_t[18]' (aka 'unsigned long long[18]') Workqueue: gve gve_service_task [gve] Call Trace: <TASK> dump_stack_lvl+0x33/0xa0 __ubsan_handle_out_of_bounds+0xdc/0x110 gve_tx_stop_ring_dqo+0x182/0x200 [gve] gve_close+0x1be/0x450 [gve] gve_reset+0x99/0x120 [gve] gve_service_task+0x61/0x100 [gve] process_scheduled_works+0x1e9/0x380 Fix this by properly checking for QPL mode and delegating to gve_free_tx_qpl_bufs() to reclaim the buffers.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.12%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.12% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu131 products
- linux< 6.8.0-136.136 | All versions (No fix recorded)
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1061.64 | All versions (No fix recorded)
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, < 71511dae56a75ce161aa746741e5c498feaea393 | ≥ a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, < c171f90f58974c784db25e0606051541cb71b7f0 | ≥ a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, < 07e0c80e17ef781799e7cd5c41a7bf44f1bf6a5f | ≥ a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, < 3744ebd8ffaa542ae8110fb449adcac0202f4cc8 | ≥ a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, < fb868db5f4bccd7a78219313ab2917429f715cea | 6.6
- linux_kernel≥ 6.6.1, < 6.6.130 | ≥ 6.7, < 6.12.78 | ≥ 6.13, < 6.18.17 | ≥ 6.19, < 6.19.7 | 6.6 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6 | 7.0:rc7
Debian1 product
- linux< 6.12.85-1 | < 6.19.8-1
3 vendors · 134 products
