EUVD-2026-67485
GHSA-rxrh-5g8p-wjx5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Triggering a specific out-of-bounds CQE index in a hardware-specific driver path warrants AC:H; most plausible impact is crash (A:H) with possible limited memory read (C:L), not integrity loss.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
qede: fix out-of-bounds check for cqe->len_list[]
Move index check before element access.
AnalysisAI
Out-of-bounds memory access in the Linux kernel's qede network driver (QLogic FastLinQ/QL4xxx Ethernet) occurs because the driver reads into cqe->len_list[] before validating the index, allowing a crafted or malformed completion-queue entry to trigger reads past the array bounds. The flaw affects multiple stable branches (5.15, 6.1, 6.6, 6.12, 6.17/6.18) on systems that load the qede driver, with a vendor fix that reorders the bounds check before element access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to be running the Linux qede driver, i.e., a system equipped with Marvell/QLogic FastLinQ (QL4xxx/45xxx) Ethernet hardware with the module loaded - systems without that NIC are not exploitable regardless of the network CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to the fixed stable release for your branch - 5.15.212, 6.1.178, 6.6.145, 6.12.97, or 6.18.40 (development fixes in 7.1.5/7.2), which reorder the len_list[] bounds check before element access; apply via your distribution's kernel update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Linux systems using QLogic FastLinQ or QL4xxx Ethernet adapters, documenting their current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today