Kernel Vulnerability in qed Drivers Affecting Linux Systems

CVE-2025-39949

What is CVE-2025-39949?

A vulnerability in the Linux kernel related to the qed drivers can lead to a buffer overflow, causing a kernel panic. When firmware returns an excessive number of protection override GRC elements, it attempts to write beyond the allocated memory buffer, triggering a critical error. This can occur through either the qede Ethernet driver or the qedf storage driver paths. The issue underscores the importance of capping the firmware's return values to prevent system instability and enhance overall security.

References