CVE-2025-39949: qed: Don't collect too many protection override GRC elements
In the Linux kernel, the following vulnerability has been resolved:
qed: Don't collect too many protection override GRC elements
In the protection override dump path, the firmware can return far too many GRC elements, resulting in attempting to write past the end of the previously-kmalloc'ed dump buffer.
This will result in a kernel panic with reason:
BUG: unable to handle kernel paging request at ADDRESS
where "ADDRESS" is just past the end of the protection override dump buffer. The start address of the buffer is: phwfn->cdev->dbgfeatures[DBGFEATUREPROTECTIONOVERRIDE].dumpbuf and the size of the buffer is bufsize in the same data structure.
The panic can be arrived at from either the qede Ethernet driver path:
[exception RIP: qedgrcdumpaddrrange+0x108] qedprotectionoverridedump at ffffffffc02662ed [qed] qeddbgprotectionoverridedump at ffffffffc0267792 [qed] qeddbgfeature at ffffffffc026aa8f [qed] qeddbgalldata at ffffffffc026b211 [qed] qedfwfatalreporterdump at ffffffffc027298a [qed] devlinkhealthdodump at ffffffff82497f61 devlinkhealthreport at ffffffff8249cf29 qedreportfatalerror at ffffffffc0272baf [qed] qedesptask at ffffffffc045ed32 [qede] processonework at ffffffff81d19783
or the qedf storage driver path:
[exception RIP: qedgrcdumpaddrrange+0x108] qedprotectionoverridedump at ffffffffc068b2ed [qed] qeddbgprotectionoverridedump at ffffffffc068c792 [qed] qeddbgfeature at ffffffffc068fa8f [qed] qeddbgalldata at ffffffffc0690211 [qed] qedfwfatalreporterdump at ffffffffc069798a [qed] devlinkhealthdodump at ffffffff8aa95e51 devlinkhealthreport at ffffffff8aa9ae19 qedreportfatalerror at ffffffffc0697baf [qed] qedhwerrnotify at ffffffffc06d32d7 [qed] qedspqpost at ffffffffc06b1011 [qed] qedfcoedestroyconn at ffffffffc06b2e91 [qed] qedfcleanupfcport at ffffffffc05e7597 [qedf] qedfrporteventhandler at ffffffffc05e7bf7 [qedf] fcrportwork at ffffffffc02da715 [libfc] processonework at ffffffff8a319663
Resolve this by clamping the firmware's return value to the maximum number of legal elements the firmware should return.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement the fix in the protection override dump path by clamping the firmware's returned number/value of protection override GRC elements to the maximum allowed, so the dump does not write past the end of the pre-allocated dump buffer (referenced by buf_size / dump_buf).
Linux kernel (qed/qede protection override dump path) Firmware protection override GRC elements return value = Clamp firmware return value to maximum legal number of elements before writing into previously-kmalloc'ed dump buffer (avoid writing past end)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39949?
CVE-2025-39949 is classified as a vulnerability in the Linux kernel that can lead to potential system instability.
How do I fix CVE-2025-39949?
To fix CVE-2025-39949, update the Linux kernel to the latest stable version that includes the security patch.
What does CVE-2025-39949 affect?
CVE-2025-39949 affects systems running the Linux kernel, particularly in its handling of protection override GRC elements.
Can CVE-2025-39949 lead to data loss?
Yes, CVE-2025-39949 can potentially lead to data corruption or loss by writing past allocated memory limits.
What are the symptoms of CVE-2025-39949 exploitation?
Symptoms may include system crashes, unexpected behavior, or performance degradation in affected systems.