Skip to main content

Linux Kernel CVE-2025-40252

| EUVDEUVD-2025-201205 CRITICAL
2025-12-04 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.8 MEDIUM

Triggered by packets (AV:N) but needs a rare malformed hardware CQE terminator (AC:H); it is an out-of-bounds read, so C:L info leak and A:L crash, no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
4.7 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
9.8 (CRITICAL)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 16:35 euvd
EUVD-2025-201205
Analysis Generated
Mar 15, 2026 - 16:35 vuln.today
CVE Published
Dec 04, 2025 - 16:16 cve.org
CRITICAL 9.8
CVE Published
Dec 04, 2025 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array.

Add an explicit bound check using ARRAY_SIZE() in both loops to prevent a potential out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

AnalysisAI

Out-of-bounds read in the Linux kernel's QLogic qede (FastLinQ 4xxxx) Ethernet driver arises in the TPA hardware-aggregation handlers qede_tpa_cont() and qede_tpa_end(), where loops walk the fixed-size cqe->len_list[] array using only a zero-length terminator as the stop condition; a missing or malformed terminator lets the loop read past the array. It affects systems running the qede driver on QLogic FastLinQ NICs and, if triggered, exposes the kernel to adjacent-memory disclosure or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and the flaw was found by static analysis (SVACE) rather than observed exploitation, so the published 9.8 CVSS appears substantially inflated relative to the true read-primitive impact.

Technical ContextAI

The affected code is the QLogic qede network driver, which handles TPA (Transparent/TCP Packet Aggregation, the driver's hardware LRO/GRO offload). When aggregated segments arrive, the NIC firmware produces completion queue entries (CQEs) whose len_list[] array describes the constituent buffer lengths; the driver's qede_tpa_cont() and qede_tpa_end() iterate this fixed-size array and stop only when they encounter a zero-length entry. Because there was no explicit index bound, a CQE lacking a proper zero terminator drives the loop past the end of len_list[], reading adjacent kernel memory. The fix adds an ARRAY_SIZE()-based bound check to both loops. No CWE was assigned in the input, but the root cause is a classic out-of-bounds read (CWE-125) from trusting an in-band terminator instead of enforcing the array's compile-time size. The trigger data originates from the QLogic FastLinQ 4xxxx hardware/firmware path, not directly from arbitrary user input.

RemediationAI

Update to a kernel that includes the fix: Vendor-released patch in 5.15.197, 6.1.159, 6.6.118, 6.12.60, 6.17.10, or 6.18 (or later on each branch). On enterprise distributions, apply the corresponding packages via Debian DLA-4436-1 (https://security-tracker.debian.org/tracker/dla-4436-1) and Ubuntu USN-8094-1/USN-8095-1/USN-8096-1 (https://ubuntu.com/security/notices/), and consult Siemens SSA-253495 (https://cert-portal.siemens.com/productcert/html/ssa-253495.html) for affected appliances. If you cannot patch immediately and the host does not use QLogic FastLinQ hardware, the qede driver is not loaded and you are not exposed; where it is unneeded you can blacklist the qede module (modprobe blacklist) as a compensating control, with the trade-off that it disables those NIC ports entirely. Disabling TPA/LRO hardware aggregation on the affected interface (via ethtool -K <iface> lro off, where supported) reduces exposure to the aggregation path at the cost of some receive-throughput/CPU efficiency. There is no network-facing configuration switch that eliminates the flaw short of the patch, so upgrading the kernel is the definitive fix.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

Debian

linux
Release Status Fixed Version Urgency
bullseye vulnerable 5.10.223-1 -
bullseye (security) vulnerable 5.10.251-1 -
bookworm fixed 6.1.159-1 -
bookworm (security) fixed 6.1.164-1 -
trixie fixed 6.12.63-1 -
trixie (security) fixed 6.12.74-2 -
forky fixed 6.19.6-2 -
sid fixed 6.19.8-1 -
(unstable) fixed 6.17.10-1 -
linux-6.1
Release Status Fixed Version Urgency
bullseye (security) fixed 6.1.164-1~deb11u1 -
bullseye fixed 6.1.159-1~deb11u1 -
DLA-4436-1

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40252 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy