Executive brief
A vulnerability was identified in the Linux kernel's QLogic QEDE network driver. This driver manages high-performance network interface cards used in servers. A flaw in how the driver processes network data packets could allow the system to read memory outside of designated areas, potentially leading to system instability or crashes.
Technical details
An out-of-bounds read vulnerability exists in the QLogic QEDE network driver within the 'qede_tpa_cont()' and 'qede_tpa_end()' functions in 'drivers/net/ethernet/qlogic/qede/qede_fp.c'. The vulnerability is caused by loops that iterate over the 'cqe->len_list[]' array relying solely on a zero-length terminator as a stopping condition. If this terminator is missing or malformed, the driver may read past the end of the fixed-size array. An attacker could potentially exploit this to cause a kernel panic (DoS) or leak sensitive kernel memory. The fix introduces explicit bounds checking using ARRAY_SIZE() to ensure the loop does not exceed the array's limits.
Affected products
- Linux Linux Kernel Fixed in 6.1.120, 6.6.64, 6.11.11, 6.12.2, and 6.13-rc1
Timeline
- 2025-11-13: other: Patch submitted by developer
- 2025-12-04: advisory: CVE-2025-40252 published
References
- https://git.kernel.org/stable/c/896f1a2493b59beb2b5ccdf990503dbb16cb2256
- https://git.kernel.org/stable/c/917a9d02182ac8b4f25eb47dc02f3ec679608c24
- https://git.kernel.org/stable/c/a778912b4a53587ea07d85526d152f85d109cbfe
- https://git.kernel.org/stable/c/e441db07f208184e0466abf44b389a81d70c340e
- https://git.kernel.org/stable/c/ecbb12caf399d7cf364b7553ed5aebeaa2f255bc
- https://git.kernel.org/stable/c/f0923011c1261b33a2ac1de349256d39cb750dd0
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html