CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
In the Linux kernel, the following vulnerability has been resolved:
net: qlogic/qede: fix potential out-of-bounds read in qedetpacont() and qedetpaend()
The loops in 'qedetpacont()' and 'qedetpaend()', iterate over 'cqe->lenlist[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array.
Add an explicit bound check using ARRAYSIZE() in both loops to prevent a potential out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: qlogic/qede: fix potential out-of-bounds read in qedetpacont() and qedetpaend()
The loops in 'qedetpacont()' and 'qedetpaend()', iterate over 'cqe-lenlist[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array.
Add an explicit bound check using ARRAYSIZE() in both loops to prevent a potential out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40252?
CVE-2025-40252 has been classified with moderate severity due to the potential out-of-bounds read vulnerability.
How do I fix CVE-2025-40252?
To fix CVE-2025-40252, upgrade to the latest version of the Linux kernel where this vulnerability has been resolved.
What systems are affected by CVE-2025-40252?
CVE-2025-40252 affects versions of the Linux kernel that implement the qlogic/qede driver.
What are the potential consequences of CVE-2025-40252?
Exploitation of CVE-2025-40252 may lead to arbitrary memory access, potentially resulting in system instability.
Is there a workaround for CVE-2025-40252?
Currently, there are no known workarounds for CVE-2025-40252 other than applying the kernel update.