CVE-2025-40252

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40252", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.181Z", "datePublished": "2025-12-04T16:08:14.393Z", "dateUpdated": "2026-10-15T22:02:41.799Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:54.857Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()\n\nThe loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate\nover 'cqe->len_list[]' using only a zero-length terminator as\nthe stopping condition. If the terminator was missing or\nmalformed, the loop could run past the end of the fixed-size array.\n\nAdd an explicit bound check using ARRAY_SIZE() in both loops to prevent\na potential out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable TPA/GRO completion-descriptor handling runs in the qede NAPI receive path, driven entirely by packets arriving from the network on a Marvell/QLogic FastLinQ NIC typically deployed in internet-facing datacenter and cloud servers. The `len_list[]` contents are produced by hardware coalescing of remotely-sent TCP segments, so an off-path/remote peer supplies the data that drives the loop.\nAC:L - The overrun occurs whenever the aggregation fills all `len_list[]` slots leaving no zero terminator, a condition an attacker steers directly by sending high-rate/crafted TCP bursts that maximize the number of BDs per aggregation. No unpredictable memory layout or victim state is required, and the attack can be repeated indefinitely until it lands.\nPR:N - Sending Ethernet/TCP traffic to a host requires no credentials or account on the target; the RX path processes frames before any authentication or socket-level authorization. The driver parses the completion descriptor unconditionally in softirq context.\nUI:N - Packet reception and TPA aggregation happen automatically in the NAPI poll routine with no involvement from any logged-in user. No file must be opened, no filesystem mounted, and no configuration action performed.\nS:U - The out-of-bounds read and the resulting skb fragment-array corruption are confined to kernel memory under the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop reads past `len_list[]` into adjacent DMA-mapped completion-ring memory, and the resulting garbage lengths are used to build skb fragments at arbitrary offsets/sizes within RX pages, which `napi_gro_receive()` then delivers up the stack to sockets \u2014 leaking uninitialized kernel/RX-ring memory to a remote peer.\nI:H - `qede_fill_frag_skb()` increments `tpa_info->frag_id` with no `MAX_SKB_FRAGS` bound, so the extra iterations write page pointer/offset/length triplets past `skb_shinfo(skb)->frags[]` \u2014 a controllable heap out-of-bounds write \u2014 and simultaneously over-consume the RX BD ring, corrupting driver state and adjacent slab objects in a way exploitable for control-flow hijack.\nA:H - Overrunning the skb shared-info fragment array and desynchronizing the RX BD ring reliably produces oops/panic (bad page state, DMA unmap of bogus mappings, refcount corruption) in softirq context, taking the machine down. The condition is remotely repeatable, so recovery is not possible while the attacker keeps sending traffic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "versions": [{"version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "ecbb12caf399d7cf364b7553ed5aebeaa2f255bc", "status": "affected", "versionType": "git"}, {"version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "a778912b4a53587ea07d85526d152f85d109cbfe", "status": "affected", "versionType": "git"}, {"version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "f0923011c1261b33a2ac1de349256d39cb750dd0", "status": "affected", "versionType": "git"}, {"version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "917a9d02182ac8b4f25eb47dc02f3ec679608c24", "status": "affected", "versionType": "git"}, {"version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "e441db07f208184e0466abf44b389a81d70c340e", "status": "affected", "versionType": "git"}, {"version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "896f1a2493b59beb2b5ccdf990503dbb16cb2256", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "versions": [{"version": "4.6", "status": "affected"}, {"version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.197", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.159", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.118", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.60", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.10", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.15.197"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.1.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.6.118"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.12.60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.17.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ecbb12caf399d7cf364b7553ed5aebeaa2f255bc"}, {"url": "https://git.kernel.org/stable/c/a778912b4a53587ea07d85526d152f85d109cbfe"}, {"url": "https://git.kernel.org/stable/c/f0923011c1261b33a2ac1de349256d39cb750dd0"}, {"url": "https://git.kernel.org/stable/c/917a9d02182ac8b4f25eb47dc02f3ec679608c24"}, {"url": "https://git.kernel.org/stable/c/e441db07f208184e0466abf44b389a81d70c340e"}, {"url": "https://git.kernel.org/stable/c/896f1a2493b59beb2b5ccdf990503dbb16cb2256"}], "title": "net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:00:07.644Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40252", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:58:26.223258Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:41.799Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:00:07.644Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40252", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:58:26.223258Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:58:26.746Z"}}], "cna": {"title": "net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable TPA/GRO completion-descriptor handling runs in the qede NAPI receive path, driven entirely by packets arriving from the network on a Marvell/QLogic FastLinQ NIC typically deployed in internet-facing datacenter and cloud servers. The `len_list[]` contents are produced by hardware coalescing of remotely-sent TCP segments, so an off-path/remote peer supplies the data that drives the loop.\nAC:L - The overrun occurs whenever the aggregation fills all `len_list[]` slots leaving no zero terminator, a condition an attacker steers directly by sending high-rate/crafted TCP bursts that maximize the number of BDs per aggregation. No unpredictable memory layout or victim state is required, and the attack can be repeated indefinitely until it lands.\nPR:N - Sending Ethernet/TCP traffic to a host requires no credentials or account on the target; the RX path processes frames before any authentication or socket-level authorization. The driver parses the completion descriptor unconditionally in softirq context.\nUI:N - Packet reception and TPA aggregation happen automatically in the NAPI poll routine with no involvement from any logged-in user. No file must be opened, no filesystem mounted, and no configuration action performed.\nS:U - The out-of-bounds read and the resulting skb fragment-array corruption are confined to kernel memory under the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop reads past `len_list[]` into adjacent DMA-mapped completion-ring memory, and the resulting garbage lengths are used to build skb fragments at arbitrary offsets/sizes within RX pages, which `napi_gro_receive()` then delivers up the stack to sockets \u2014 leaking uninitialized kernel/RX-ring memory to a remote peer.\nI:H - `qede_fill_frag_skb()` increments `tpa_info->frag_id` with no `MAX_SKB_FRAGS` bound, so the extra iterations write page pointer/offset/length triplets past `skb_shinfo(skb)->frags[]` \u2014 a controllable heap out-of-bounds write \u2014 and simultaneously over-consume the RX BD ring, corrupting driver state and adjacent slab objects in a way exploitable for control-flow hijack.\nA:H - Overrunning the skb shared-info fragment array and desynchronizing the RX BD ring reliably produces oops/panic (bad page state, DMA unmap of bogus mappings, refcount corruption) in softirq context, taking the machine down. The condition is remotely repeatable, so recovery is not possible while the attacker keeps sending traffic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "ecbb12caf399d7cf364b7553ed5aebeaa2f255bc", "versionType": "git"}, {"status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "a778912b4a53587ea07d85526d152f85d109cbfe", "versionType": "git"}, {"status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "f0923011c1261b33a2ac1de349256d39cb750dd0", "versionType": "git"}, {"status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "917a9d02182ac8b4f25eb47dc02f3ec679608c24", "versionType": "git"}, {"status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "e441db07f208184e0466abf44b389a81d70c340e", "versionType": "git"}, {"status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "lessThan": "896f1a2493b59beb2b5ccdf990503dbb16cb2256", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"status": "unaffected", "version": "0", "lessThan": "4.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.197", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.159", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.118", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.60", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.10", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ecbb12caf399d7cf364b7553ed5aebeaa2f255bc"}, {"url": "https://git.kernel.org/stable/c/a778912b4a53587ea07d85526d152f85d109cbfe"}, {"url": "https://git.kernel.org/stable/c/f0923011c1261b33a2ac1de349256d39cb750dd0"}, {"url": "https://git.kernel.org/stable/c/917a9d02182ac8b4f25eb47dc02f3ec679608c24"}, {"url": "https://git.kernel.org/stable/c/e441db07f208184e0466abf44b389a81d70c340e"}, {"url": "https://git.kernel.org/stable/c/896f1a2493b59beb2b5ccdf990503dbb16cb2256"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()\n\nThe loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate\nover 'cqe->len_list[]' using only a zero-length terminator as\nthe stopping condition. If the terminator was missing or\nmalformed, the loop could run past the end of the fixed-size array.\n\nAdd an explicit bound check using ARRAY_SIZE() in both loops to prevent\na potential out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.197", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.159", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.118", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.60", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.10", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "4.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:54.857Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40252", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:41.799Z", "dateReserved": "2025-04-16T07:20:57.181Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-04T16:08:14.393Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ecbb12caf399d7cf364b7553ed5aebeaa2f255bc", "status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "versionType": "git"}, {"lessThan": "a778912b4a53587ea07d85526d152f85d109cbfe", "status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "versionType": "git"}, {"lessThan": "f0923011c1261b33a2ac1de349256d39cb750dd0", "status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "versionType": "git"}, {"lessThan": "917a9d02182ac8b4f25eb47dc02f3ec679608c24", "status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "versionType": "git"}, {"lessThan": "e441db07f208184e0466abf44b389a81d70c340e", "status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "versionType": "git"}, {"lessThan": "896f1a2493b59beb2b5ccdf990503dbb16cb2256", "status": "affected", "version": "55482edc25f0606851de42e73618f813f310d009", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/qlogic/qede/qede_fp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.197", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.159", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.118", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.60", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V4.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()\n\nThe loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate\nover 'cqe->len_list[]' using only a zero-length terminator as\nthe stopping condition. If the terminator was missing or\nmalformed, the loop could run past the end of the fixed-size array.\n\nAdd an explicit bound check using ARRAY_SIZE() in both loops to prevent\na potential out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: qlogic/qede: corrige posible lectura fuera de l\u00edmites en qede_tpa_cont() y qede_tpa_end()\n\nLos bucles en 'qede_tpa_cont()' y 'qede_tpa_end()' iteran sobre 'cqe -> len_list[]' utilizando \u00fanicamente un terminador de longitud cero como condici\u00f3n de parada. Si el terminador faltaba o estaba malformado, el bucle podr\u00eda ejecutarse m\u00e1s all\u00e1 del final del array de tama\u00f1o fijo.\n\nA\u00f1ade una comprobaci\u00f3n de l\u00edmites expl\u00edcita utilizando ARRAY_SIZE() en ambos bucles para prevenir un posible acceso fuera de l\u00edmites.\n\nEncontrado por Linux Verification Center (linuxtesting.org) con SVACE."}], "id": "CVE-2025-40252", "lastModified": "2026-10-19T19:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40252", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:58:26.223258Z", "version": "2.0.3"}}]}, "published": "2025-12-04T16:16:18.807", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/896f1a2493b59beb2b5ccdf990503dbb16cb2256"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/917a9d02182ac8b4f25eb47dc02f3ec679608c24"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a778912b4a53587ea07d85526d152f85d109cbfe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e441db07f208184e0466abf44b389a81d70c340e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ecbb12caf399d7cf364b7553ed5aebeaa2f255bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f0923011c1261b33a2ac1de349256d39cb750dd0"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()", "id": "2418875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418875"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()\nThe loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate\nover 'cqe->len_list[]' using only a zero-length terminator as\nthe stopping condition. If the terminator was missing or\nmalformed, the loop could run past the end of the fixed-size array.\nAdd an explicit bound check using ARRAY_SIZE() in both loops to prevent\na potential out-of-bounds access.\nFound by Linux Verification Center (linuxtesting.org) with SVACE."], "name": "CVE-2025-40252", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40252\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40252\nhttps://lore.kernel.org/linux-cve-announce/2025120431-CVE-2025-40252-2d9b@gregkh/T"], "threat_severity": "Moderate"}

{}