# CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL

CVE-2026-23386 is fixed in 50 products on 1 platform, first by DEBIAN-CVE-2026-23386, released March 25, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-23386
- Priority: High
- CVSS: 7.1 (Important)
- EPSS: 0.0012
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 25, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23386

## Description

In the Linux kernel, the following vulnerability has been resolved:  gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL  In DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA buffer cleanup path. It iterates num_bufs times and attempts to unmap entries in the dma array.  This leads to two issues: 1. The dma array shares storage with tx_qpl_buf_ids (union).  Interpreting buffer IDs as DMA addresses results in attempting to  unmap incorrect memory locations. 2. num_bufs in QPL mode (counting 2K chunks) can significantly exceed  the size of the dma array, causing out-of-bounds access warnings (trace below is how we noticed this issue).  UBSAN: array-index-out-of-bounds in drivers/net/ethernet/drivers/net/ethernet/google/gve/gve_tx_dqo.c:178:5 index 18 is out of range for type 'dma_addr_t[18]' (aka 'unsigned long long[18]') Workqueue: gve gve_service_task [gve] Call Trace: <TASK> dump_stack_lvl+0x33/0xa0 __ubsan_handle_out_of_bounds+0xdc/0x110 gve_tx_stop_ring_dqo+0x182/0x200 [gve] gve_close+0x1be/0x450 [gve] gve_reset+0x99/0x120 [gve] gve_service_task+0x61/0x100 [gve] process_scheduled_works+0x1e9/0x380  Fix this by properly checking for QPL mode and delegating to gve_free_tx_qpl_bufs() to reclaim the buffers.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | dtb-aarch64 opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-64kb opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-azure opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-default opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-default-base opensuse-leap 16.0 | 6.12.0-160000.27.1.160000.2.8 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-docs opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-kvmsmall opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-livepatch-SLE15-SP7-RT_Update_11 sles 15.7 | 1-150700.1.3.1 | [SUSE-SU-2026:1573-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1573-1.md) | Apr 23, 2026 |
| Linux | kernel-obs-build opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-obs-qa opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-rt opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-source opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-syms opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | kernel-uek ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-devel ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-devel ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-deprecated ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-deprecated ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-desktop ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-desktop ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-extra ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-extra ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-extra-netfilter ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-extra-netfilter ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-usb ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-usb ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-wireless ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-debug-modules-wireless ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-devel ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-devel ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-doc ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-doc ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-deprecated ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-deprecated ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-desktop ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-desktop ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-extra ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-extra ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-extra-netfilter ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-extra-netfilter ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-usb ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-usb ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-wireless ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-modules-wireless ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-tools ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek-tools ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-devel ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-devel ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-deprecated ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-deprecated ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-desktop ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-desktop ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-extra ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-extra ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-extra-netfilter ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-extra-netfilter ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-usb ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-usb ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-wireless ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-uek64k-modules-wireless ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 |
| Linux | kernel-zfcpdump opensuse-leap 16.0 | 6.12.0-160000.28.1 | [OPENSUSE-SU-2026:20572-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20572-1.md) | Apr 20, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.85-1 | [DEBIAN-CVE-2026-23386](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23386.md) | Mar 25, 2026 |
| Linux | linux Debian 14 | 6.19.8-1 | [DEBIAN-CVE-2026-23386](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23386.md) | Mar 25, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.