LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL

In the Linux kernel, the following vulnerability has been resolved: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL In DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA buffer cleanup path. It iterates num_bufs times and attempts to unmap entries in the dma array. This leads to two issues: 1. The dma array shares storage with tx_qpl_buf_ids (union). Interpreting buffer IDs as DMA addresses results in attempting to unmap incorrect memory locations. 2. num_bufs in QPL mode (counting 2K chunks) can significantly exceed the size of the dma array, causing out-of-bounds access warnings (trace below is how we noticed this issue). UBSAN: array-index-out-of-bounds in drivers/net/ethernet/drivers/net/ethernet/google/gve/gve_tx_dqo.c:178:5 index 18 is out of range for type 'dma_addr_t[18]' (aka 'unsigned long long[18]') Workqueue: gve gve_service_task [gve] Call Trace: <TASK> dump_stack_lvl+0x33/0xa0 __ubsan_handle_out_of_bounds+0xdc/0x110 gve_tx_stop_ring_dqo+0x182/0x200 [gve] gve_close+0x1be/0x450 [gve] gve_reset+0x99/0x120 [gve] gve_service_task+0x61/0x100 [gve] process_scheduled_works+0x1e9/0x380 Fix this by properly checking for QPL mode and delegating to gve_free_tx_qpl_bufs() to reclaim the buffers.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel network-driver bug in Google Virtual Ethernet. In a specific QPL transmit cleanup path, the driver can treat buffer identifiers as DMA addresses and read past an array. The source shows kernel warnings during reset/close handling, but does not provide a CVSS score or confirmed security impact.

Executive priority

Treat this as a targeted kernel maintenance item, highest for workloads depending on gve networking. There is no cited exploitation or CVSS score, so urgency should be driven by exposure to affected kernels and availability sensitivity.

Technical view

In gve DQ-QPL mode, gve_tx_clean_pending_packets() used the RDA cleanup path. Because dma shares union storage with tx_qpl_buf_ids, cleanup interpreted buffer IDs as DMA addresses, and num_bufs could exceed the dma array length. The kernel fix routes QPL cleanup through gve_free_tx_qpl_bufs().

Likely exposure

Exposure appears limited to Linux systems running affected kernel builds with the Google gve driver using DQ-QPL mode. The bundle lists Linux as affected, but provides no distribution-specific package names, configurations, or CPEs.

Exploitation context

No active exploitation is cited, and KEV is false. The provided evidence is a kernel bug report and stable fixes, not an exploit report. The observed failure mode is an UBSAN out-of-bounds warning during gve reset/close cleanup.

Researcher notes

The key condition is DQ-QPL cleanup in gve_tx_clean_pending_packets(). The vulnerable behavior is misuse of the RDA cleanup path against QPL buffer IDs and num_bufs semantics. Evidence does not establish privilege requirements, attacker control, or exploitability beyond the reported out-of-bounds warning.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable gve fixes.
  • Check distribution vendor advisories for backported kernel packages.
  • Prioritize systems using the gve driver in production network paths.
  • If patch timing is constrained, seek vendor guidance for supported mitigations.

Validation and detection

  • Inventory hosts for Linux kernels and loaded gve driver usage.
  • Compare running kernel packages against distribution advisories for CVE-2026-23386.
  • Review kernel logs for gve reset, close, or UBSAN out-of-bounds messages.
  • Confirm updated kernels include the QPL cleanup fix commits.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23386 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa6fb8d5a8b6925f1e635818d3dd2d89531d4a058, a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, a6fb8d5a8b6925f1e635818d3dd2d89531d4a058unaffected
LinuxLinux6.6, 0, 6.6.130, 6.12.78, 6.18.17, 6.19.7, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.