Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2025-40252

net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array. Add an explicit bound check using ARRAY_SIZE() in both loops to prevent a potential out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 55482edc25f0606851de42e73618f813f310d009 to < ecbb12caf399d7cf364b7553ed5aebeaa2f255bcaffected
  • 55482edc25f0606851de42e73618f813f310d009 to < a778912b4a53587ea07d85526d152f85d109cbfeaffected
  • 55482edc25f0606851de42e73618f813f310d009 to < f0923011c1261b33a2ac1de349256d39cb750dd0affected
  • 55482edc25f0606851de42e73618f813f310d009 to < 917a9d02182ac8b4f25eb47dc02f3ec679608c24affected
  • 55482edc25f0606851de42e73618f813f310d009 to < e441db07f208184e0466abf44b389a81d70c340eaffected
  • 55482edc25f0606851de42e73618f813f310d009 to < 896f1a2493b59beb2b5ccdf990503dbb16cb2256affected

Linux Linux

Default version status: affected

  • 4.6affected
  • 0 to < 4.6unaffected
  • 5.15.197 to ≤ 5.15.*unaffected
  • 6.1.159 to ≤ 6.1.*unaffected
  • 6.6.118 to ≤ 6.6.*unaffected
  • 6.12.60 to ≤ 6.12.*unaffected
  • 6.17.10 to ≤ 6.17.*unaffected
  • 6.18 to ≤ *unaffected

References