CVE-2025-40177: accel/qaic: Fix bootlog initialization ordering
In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: Fix bootlog initialization ordering
As soon as we queue MHI buffers to receive the bootlog from the device, we could be receiving data. Therefore all the resources needed to process that data need to be setup prior to queuing the buffers.
We currently initialize some of the resources after queuing the buffers which creates a race between the probe() and any data that comes back from the device. If the uninitialized resources are accessed, we could see page faults.
Fix the init ordering to close the race.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Initialize all resources needed to process bootlog data before queuing MHI buffers, closing the race between probe() initialization and incoming device data.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40177?
CVE-2025-40177 has a low severity rating due to its narrow impact scope.
How do I fix CVE-2025-40177?
To fix CVE-2025-40177, update to the latest version of the Linux kernel where the vulnerability has been addressed.
What software is affected by CVE-2025-40177?
CVE-2025-40177 affects the Linux kernel across specified versions, particularly those utilizing the accel/qaic module.
What causes CVE-2025-40177?
CVE-2025-40177 is caused by improper bootlog initialization ordering when processing MHI buffers.
Is CVE-2025-40177 exploitable?
CVE-2025-40177 is not considered easily exploitable outside of specific conditions that may not typically occur.