The vulnerability resides in the Linux kernel’s qede network driver, where an out‑of‑bounds read of the cqe->len_list array is possible because the index check is performed after element access. The fix moves the check to precede the access. This flaw could allow an attacker who can trigger the driver’s array access to read memory beyond the intended bounds, potentially exposing kernel memory or causing instability.

All Linux kernel installations that include the qede driver prior to the commit that introduced the fix are vulnerable. The unmatched version information in public references means any distribution with an unpatched qede driver is at risk.

The CVSS score of 9.8 denotes a critical severity, the EPSS score of <1% indicates a very low probability of exploitation, and the entry is not listed in the CISA KEV catalog. The vulnerability is an out‑of‑bounds read in the Linux qede driver’s handling of cqe->len_list. The CVE description does not mention a public exploit or a particular access requirement; however, the flaw resides in kernel space and would be triggered by code that invokes the qede driver’s packet handling logic. Based on the description, it is inferred that an attacker would need to provide specially crafted network traffic to the qede driver or otherwise cause it to read from the array out of bounds. Thus, the primary risk involves potential leakage of kernel memory and associated instability if the vulnerable code path is exercised. The exact likelihood of exploitation is low, but the impact remains high if the flaw is successfully triggered.