Executive brief
A vulnerability in the Linux kernel's QLogic 'qed' driver could allow a local user to cause a system crash. The driver, which manages high-speed network and storage adapters, fails to properly limit data received from the hardware's firmware during diagnostic dumps. This can lead to a kernel panic, resulting in a complete service outage and potential system instability.
Technical details
A heap-based buffer overflow exists in the qed driver's protection override dump path. The root cause is a failure to validate the number of GRC elements returned by the firmware against the size of the kmalloc'ed 'dump_buf'. When the firmware returns more elements than expected, the 'qed_protection_override_dump' function attempts to write past the end of the allocated buffer, triggering a kernel paging request violation and subsequent panic. This can be triggered via both the 'qede' (Ethernet) and 'qedf' (FCoE storage) driver paths during fatal error reporting or health dumps. The fix implements clamping of the firmware's return value using the 'min()' macro to ensure it does not exceed 'PROTECTION_OVERRIDE_DEPTH_DWORDS'.
Affected products
- Linux Linux Kernel d52c89f120de849575f6b2e5948038f2be12ce6f to 56c0a2a9ddc2f5b5078c5fb0f81ab76bbc3d4c37
Timeline
- 2025-09-10: other: Vulnerability fix authored
- 2025-10-02: patched: Fix committed to stable tree
- 2025-10-04: advisory: CVE published
References
- https://git.kernel.org/stable/c/25672c620421fa2105703a94a29a03487245e6d6
- https://git.kernel.org/stable/c/56c0a2a9ddc2f5b5078c5fb0f81ab76bbc3d4c37
- https://git.kernel.org/stable/c/660b2a8f5a306a28c7efc1b4990ecc4912a68f87
- https://git.kernel.org/stable/c/70affe82e38fd3dc76b9c68b5a1989f11e7fa0f3
- https://git.kernel.org/stable/c/8141910869596b7a3a5d9b46107da2191d523f82
- https://git.kernel.org/stable/c/e0e24571a7b2f8c8f06e25d3417253ebbdbc8d5c
- https://git.kernel.org/stable/c/ea53e6a47e148b490b1c652fc65d2de5a086df76