Executive brief
The Linux kernel's QAIC (Qualcomm AI Compute) accelerator driver had insufficient integer overflow validation when mapping user memory pages for DMA transfers. An attacker could exploit this by providing specially crafted size values that overflow during address calculation, potentially leading to memory corruption or information disclosure on systems using this accelerator.
Technical details
The vulnerability exists in the encode_dma() and find_and_map_user_pages() functions within the QAIC accelerator driver. The root cause is inadequate checking of integer overflow when computing DMA transfer addresses and sizes. The original code checked "addr + size" against the starting address but did not properly validate partial transfers across 32-bit and 64-bit boundaries, nor did it account for page offset truncation on 32-bit systems. An attacker with access to the QAIC device interface could provide a crafted DMA transfer request with overlapping or overflowing address calculations. The fix introduces explicit overflow checks for "addr + xferred_dma_size" and "xfer_start_addr + remaining", and validates that the total allocation size (including page offset) does not exceed SIZE_MAX before calling kmalloc().
Affected products
- Linux Linux kernel multiple versions
Timeline
- 2025-12-09: disclosed