Skip to main content

Linux Kernel CVE-2025-40252

| EUVDEUVD-2025-201205 CRITICAL
2025-12-04 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach host with QLogic FastLinQ NIC
  2. Delivery
    Induce TPA aggregation on receive path
  3. Exploit
    Malformed len_list terminator processed
  4. Execution
    Loop reads past len_list[] array
  5. Impact
    Kernel memory disclosure or crash (DoS)

Vulnerability Assessment

Exploitation Conditions

Exploitation requires the target to be running the Linux qede driver on QLogic FastLinQ 4xxxx hardware with TPA (hardware LRO/GRO aggregation) active on the receive path - this is the exact feature whose handlers iterate cqe->len_list[]. The concrete precondition is a completion queue entry in which the zero-length terminator is missing or malformed, which drives the loop past the fixed array. Limiting factors are significant: the len_list terminator is generated by the NIC firmware during aggregation rather than being directly attacker-supplied bytes, so an attacker cannot straightforwardly set it over the wire; hosts without QLogic FastLinQ NICs (driver not loaded) or with LRO/TPA disabled are not exposed; and the primitive is a read, bounding impact to disclosure/crash. This is not a clean AV:N/AC:L/PR:N unauthenticated RCE against default configs despite the published vector.
Impact

The signals conflict sharply. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) is the automated kernel-CNA maximum and treats this as trivially remote-exploitable for full compromise, but the description describes only an out-of-bounds READ gated on a malformed hardware-generated CQE terminator - a value produced by the NIC firmware, not freely attacker-controlled over the network. EPSS is 0.05% (16th percentile), the CVE is NOT in CISA KEV, and no POC is referenced, all consistent with negligible real-world exploitation. The flaw was surfaced by SVACE static analysis as a 'potential' issue, further suggesting theoretical rather than demonstrated risk. My independent assessment is that attack complexity is high (requires a malformed/missing terminator condition on the aggregation path) and impact is limited to low-severity info disclosure and possible crash, not the H/H/H the score claims. This is a legitimate defensive hardening fix to patch on affected hosts, but it is a lower operational priority than the 9.8 implies - treat as high-CVSS-but-low-real-risk unless you run QLogic FastLinQ NICs in exposed roles.
Exploit ScenarioDerived

An attacker on a network path to a host with a QLogic FastLinQ NIC crafts a traffic pattern that induces the driver's TPA aggregation to build a completion entry whose len_list[] lacks a proper zero terminator, causing qede_tpa_end()/qede_tpa_cont() to read beyond the array into adjacent kernel memory. The most realistic outcome is a kernel crash (denial of service) or disclosure of small amounts of adjacent kernel data rather than code execution. No public exploit is identified, and reliably forcing the malformed-terminator condition through firmware is non-trivial, making practical exploitation unlikely.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 30, 2026

Out-of-bounds read in the Linux kernel's QLogic qede (FastLinQ 4xxxx) Ethernet driver arises in the TPA hardware-aggregation handlers qede_tpa_cont() and qede_tpa_end(), where loops walk the fixed-size cqe->len_list[] array using only a zero-length terminator as the stop condition; a missing or malformed terminator lets the loop read past the array. It affects systems running the qede driver on QLogic FastLinQ NICs and, if triggered, exposes the kernel to adjacent-memory disclosure or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and the flaw was found by static analysis (SVACE) rather than observed exploitation, so the published 9.8 CVSS appears substantially inflated relative to the true read-primitive impact.

Earlier versions of this analysis (1)
v1 Mar 15, 2026 - 16:35

RemediationAI

Update to a kernel that includes the fix: Vendor-released patch in 5.15.197, 6.1.159, 6.6.118, 6.12.60, 6.17.10, or 6.18 (or later on each branch). On enterprise distributions, apply the corresponding packages via Debian DLA-4436-1 (https://security-tracker.debian.org/tracker/dla-4436-1) and Ubuntu USN-8094-1/USN-8095-1/USN-8096-1 (https://ubuntu.com/security/notices/), and consult Siemens SSA-253495 (https://cert-portal.siemens.com/productcert/html/ssa-253495.html) for affected appliances. If you cannot patch immediately and the host does not use QLogic FastLinQ hardware, the qede driver is not loaded and you are not exposed; where it is unneeded you can blacklist the qede module (modprobe blacklist) as a compensating control, with the trade-off that it disables those NIC ports entirely. Disabling TPA/LRO hardware aggregation on the affected interface (via ethtool -K <iface> lro off, where supported) reduces exposure to the aggregation path at the cost of some receive-throughput/CPU efficiency. There is no network-facing configuration switch that eliminates the flaw short of the patch, so upgrading the kernel is the definitive fix.

Affected VersionsENISA

Linux patch: 0
Linux patch: 6.1.159
Linux patch: 6.17.10
Linux 55482edc25f0606851de42e73618f813f310d009 <a778912b4a53587ea07d85526d152f85d109cbfe
Linux 4.6
Linux 55482edc25f0606851de42e73618f813f310d009 <896f1a2493b59beb2b5ccdf990503dbb16cb2256
Linux 55482edc25f0606851de42e73618f813f310d009 <e441db07f208184e0466abf44b389a81d70c340e
Linux patch: 5.15.197
Linux patch: 6.6.118
Linux 55482edc25f0606851de42e73618f813f310d009 <f0923011c1261b33a2ac1de349256d39cb750dd0
Linux patch: 6.12.60
Linux 55482edc25f0606851de42e73618f813f310d009 <ecbb12caf399d7cf364b7553ed5aebeaa2f255bc
Linux 55482edc25f0606851de42e73618f813f310d009 <917a9d02182ac8b4f25eb47dc02f3ec679608c24
Linux patch: 6.18

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code is the QLogic qede network driver, which handles TPA (Transparent/TCP Packet Aggregation, the driver's hardware LRO/GRO offload). When aggregated segments arrive, the NIC firmware produces completion queue entries (CQEs) whose len_list[] array describes the constituent buffer lengths; the driver's qede_tpa_cont() and qede_tpa_end() iterate this fixed-size array and stop only when they encounter a zero-length entry. Because there was no explicit index bound, a CQE lacking a proper zero terminator drives the loop past the end of len_list[], reading adjacent kernel memory. The fix adds an ARRAY_SIZE()-based bound check to both loops. No CWE was assigned in the input, but the root cause is a classic out-of-bounds read (CWE-125) from trusting an in-band terminator instead of enforcing the array's compile-time size. The trigger data originates from the QLogic FastLinQ 4xxxx hardware/firmware path, not directly from arbitrary user input.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.8 MEDIUM

Triggered by packets (AV:N) but needs a rare malformed hardware CQE terminator (AC:H); it is an out-of-bounds read, so C:L info leak and A:L crash, no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 4.7 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 30, 2026 - 06:37 NVD
9.8 (CRITICAL)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
CVE Published
Dec 04, 2025 - 16:16 cve.org
CRITICAL 9.8
CVE Published
Dec 04, 2025 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array.

Add an explicit bound check using ARRAY_SIZE() in both loops to prevent a potential out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Executive ViewAI

Why It Matters

A critical out-of-bounds read vulnerability in the Linux kernel's QLogic qede Ethernet driver (CVE-2025-40252) affects systems using QLogic FastLinQ 4xxxx network interface cards. While no public exploit has been identified at time of analysis, the flaw could enable kernel memory disclosure or system crashes, requiring immediate vendor-patch deployment for operational stability and data protection.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

Threat Score
4.0/10
Composite threat intelligence
EPSS Score
0.1%
Top 84% exploitable
Prevalence
Medium
Linux kernel is ubiquitous but qede driver requires QLogic FastLinQ NICs
Threat Intel
1
1 source
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

59
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

Debian

linux
Release Status Fixed Version Urgency
bullseye vulnerable 5.10.223-1 -
bullseye (security) vulnerable 5.10.251-1 -
bookworm fixed 6.1.159-1 -
bookworm (security) fixed 6.1.164-1 -
trixie fixed 6.12.63-1 -
trixie (security) fixed 6.12.74-2 -
forky fixed 6.19.6-2 -
sid fixed 6.19.8-1 -
(unstable) fixed 6.17.10-1 -
linux-6.1
Release Status Fixed Version Urgency
bullseye (security) fixed 6.1.164-1~deb11u1 -
bullseye fixed 6.1.159-1~deb11u1 -
DLA-4436-1

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-188-05
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:13577 ADVISORY https://access.redhat.com/errata/RHSA-2026:13578 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-40252 ADVISORY https://security-tracker.debian.org/tracker/dla-4436-1 ADVISORY https://ubuntu.com/security/notices/USN-8094-1 ADVISORY https://ubuntu.com/security/notices/USN-8095-1 ADVISORY https://ubuntu.com/security/notices/USN-8096-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0278/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0281/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0315/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0316/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20207/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20220/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20228/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20479/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20498/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20564/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ REF https://cert-portal.siemens.com/productcert/html/ssa-253495.html REF https://git.kernel.org/stable/c/896f1a2493b59beb2b5ccdf990503dbb16cb2256 REF https://git.kernel.org/stable/c/917a9d02182ac8b4f25eb47dc02f3ec679608c24 REF https://git.kernel.org/stable/c/a778912b4a53587ea07d85526d152f85d109cbfe REF https://git.kernel.org/stable/c/e441db07f208184e0466abf44b389a81d70c340e REF https://git.kernel.org/stable/c/ecbb12caf399d7cf364b7553ed5aebeaa2f255bc REF https://git.kernel.org/stable/c/f0923011c1261b33a2ac1de349256d39cb750dd0

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy