Out-of-Bounds Read Vulnerability in Linux Kernel by QLogic

CVE-2025-40252

What is CVE-2025-40252?

A security vulnerability in the Linux kernel affects QLogic devices, specifically in the functions 'qede_tpa_cont()' and 'qede_tpa_end()'. In these functions, loops iterate over 'cqe->len_list[]' without a proper stopping condition, potentially leading to out-of-bounds read operations if the length terminator is missing or malformed. This could allow unauthorized access to memory beyond the bounds of the intended array, necessitating the implementation of a bound check using ARRAY_SIZE() to prevent such access and enhance security.

References