CVE-2025-40252 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
A missing bounds check in the QLogic qede network driver allows out-of-bounds reads, potentially causing crashes or leaking kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40252?
CVE-2025-40252 is a critical memory corruption vulnerability in Linux, published on 4 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array.
Add an explicit bound check using ARRAY_SIZE() in both loops to prevent a potential out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Which versions are affected by CVE-2025-40252?
How do I fix CVE-2025-40252?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-40252 being exploited?
There is no known exploitation of CVE-2025-40252 in the wild and no public exploit code.
Sources
Also known as AZL-71393, BELL-CVE-2025-40252, DEBIAN-CVE-2025-40252, GHSA-j29x-hm96-8wj9, ROOT-OS-DEBIAN-11-CVE-2025-40252, ROOT-OS-DEBIAN-12-CVE-2025-40252 and 4 more.