{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40252", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.181Z", "datePublished": "2025-12-04T16:08:14.393Z", "dateUpdated": "2026-08-05T12:08:54.857Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:54.857Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()\n\nThe loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate\nover 'cqe->len_list[]' using only a zero-length terminator as\nthe stopping condition. If the terminator was missing or\nmalformed, the loop could run past the end of the fixed-size array.\n\nAdd an explicit bound check using ARRAY_SIZE() in both loops to prevent\na potential out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable TPA/GRO completion-descriptor handling runs in the qede NAPI receive path, driven entirely by packets arriving from the network on a Marvell/QLogic FastLinQ NIC typically deployed in internet-facing datacenter and cloud servers. The `len_list[]` contents are produced by hardware coalescing of remotely-sent TCP segments, so an off-path/remote peer supplies the data that drives the loop.\nAC:L - The overrun occurs whenever the aggregation fills all `len_list[]` slots leaving no zero terminator, a condition an attacker steers directly by sending high-rate/crafted TCP bursts that maximize the number of BDs per aggregation. No unpredictable memory layout or victim state is required, and the attack can be repeated indefinitely until it lands.\nPR:N - Sending Ethernet/TCP traffic to a host requires no credentials or account on the target; the RX path processes frames before any authentication or socket-level authorization. The driver parses the completion descriptor unconditionally in softirq context.\nUI:N - Packet reception and TPA aggregation happen automatically in the NAPI poll routine with no involvement from any logged-in user. No file must be opened, no filesystem mounted, and no configuration action performed.\nS:U - The out-of-bounds read and the resulting skb fragment-array corruption are confined to kernel memory under the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop reads past `len_list[]` into adjacent DMA-mapped completion-ring memory, and the resulting garbage lengths are used to build skb fragments at arbitrary offsets/sizes within RX pages, which `napi_gro_receive()` then delivers up the stack to sockets — leaking uninitialized kernel/RX-ring memory to a remote peer.\nI:H - `qede_fill_frag_skb()` increments `tpa_info->frag_id` with no `MAX_SKB_FRAGS` bound, so the extra iterations write page pointer/offset/length triplets past `skb_shinfo(skb)->frags[]` — a controllable heap out-of-bounds write — and simultaneously over-consume the RX BD ring, corrupting driver state and adjacent slab objects in a way exploitable for control-flow hijack.\nA:H - Overrunning the skb shared-info fragment array and desynchronizing the RX BD ring reliably produces oops/panic (bad page state, DMA unmap of bogus mappings, refcount corruption) in softirq context, taking the machine down. The condition is remotely repeatable, so recovery is not possible while the attacker keeps sending traffic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/qlogic/qede/qede_fp.c" ], "versions": [ { "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "ecbb12caf399d7cf364b7553ed5aebeaa2f255bc", "status": "affected", "versionType": "git" }, { "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "a778912b4a53587ea07d85526d152f85d109cbfe", "status": "affected", "versionType": "git" }, { "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "f0923011c1261b33a2ac1de349256d39cb750dd0", "status": "affected", "versionType": "git" }, { "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "917a9d02182ac8b4f25eb47dc02f3ec679608c24", "status": "affected", "versionType": "git" }, { "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "e441db07f208184e0466abf44b389a81d70c340e", "status": "affected", "versionType": "git" }, { "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "896f1a2493b59beb2b5ccdf990503dbb16cb2256", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/qlogic/qede/qede_fp.c" ], "versions": [ { "version": "4.6", "status": "affected" }, { "version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.197", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.159", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.118", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.60", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.10", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.15.197" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.1.159" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.6.118" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.12.60" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.17.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ecbb12caf399d7cf364b7553ed5aebeaa2f255bc" }, { "url": "https://git.kernel.org/stable/c/a778912b4a53587ea07d85526d152f85d109cbfe" }, { "url": "https://git.kernel.org/stable/c/f0923011c1261b33a2ac1de349256d39cb750dd0" }, { "url": "https://git.kernel.org/stable/c/917a9d02182ac8b4f25eb47dc02f3ec679608c24" }, { "url": "https://git.kernel.org/stable/c/e441db07f208184e0466abf44b389a81d70c340e" }, { "url": "https://git.kernel.org/stable/c/896f1a2493b59beb2b5ccdf990503dbb16cb2256" } ], "title": "net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:00:07.644Z" }, "affected": [ { "vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [ { "status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" } ] } ] } }