---
id: CVE-2025-40252
title: >-
  net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and
  qede_tpa_end()
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and
  qede_tpa_end()


  The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate

  over 'cqe->len_li…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 55482edc25f0606851de42e73618f813f310d009 <
    ecbb12caf399d7cf364b7553ed5aebeaa2f255bc
  - >-
    Linux >= 55482edc25f0606851de42e73618f813f310d009 <
    a778912b4a53587ea07d85526d152f85d109cbfe
  - >-
    Linux >= 55482edc25f0606851de42e73618f813f310d009 <
    f0923011c1261b33a2ac1de349256d39cb750dd0
  - >-
    Linux >= 55482edc25f0606851de42e73618f813f310d009 <
    917a9d02182ac8b4f25eb47dc02f3ec679608c24
  - >-
    Linux >= 55482edc25f0606851de42e73618f813f310d009 <
    e441db07f208184e0466abf44b389a81d70c340e
  - >-
    Linux >= 55482edc25f0606851de42e73618f813f310d009 <
    896f1a2493b59beb2b5ccdf990503dbb16cb2256
  - Linux 4.6
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-15T21:58:26.223258Z'
published: '2025-12-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:41.799Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40252'
references:
  - url: 'https://git.kernel.org/stable/c/ecbb12caf399d7cf364b7553ed5aebeaa2f255bc'
  - url: 'https://git.kernel.org/stable/c/a778912b4a53587ea07d85526d152f85d109cbfe'
  - url: 'https://git.kernel.org/stable/c/f0923011c1261b33a2ac1de349256d39cb750dd0'
  - url: 'https://git.kernel.org/stable/c/917a9d02182ac8b4f25eb47dc02f3ec679608c24'
  - url: 'https://git.kernel.org/stable/c/e441db07f208184e0466abf44b389a81d70c340e'
  - url: 'https://git.kernel.org/stable/c/896f1a2493b59beb2b5ccdf990503dbb16cb2256'
tags:
  - cve.org
epss: 0.00602
epssPercentile: 0.47549
ingestedAt: '2026-10-15T22:48:25.553Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate
over 'cqe->len_list[]' using only a zero-length terminator as
the stopping condition. If the terminator was missing or
malformed, the loop could run past the end of the fixed-size array.

Add an explicit bound check using ARRAY_SIZE() in both loops to prevent
a potential out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

## Affected

- `Linux >= 55482edc25f0606851de42e73618f813f310d009 < ecbb12caf399d7cf364b7553ed5aebeaa2f255bc`
- `Linux >= 55482edc25f0606851de42e73618f813f310d009 < a778912b4a53587ea07d85526d152f85d109cbfe`
- `Linux >= 55482edc25f0606851de42e73618f813f310d009 < f0923011c1261b33a2ac1de349256d39cb750dd0`
- `Linux >= 55482edc25f0606851de42e73618f813f310d009 < 917a9d02182ac8b4f25eb47dc02f3ec679608c24`
- `Linux >= 55482edc25f0606851de42e73618f813f310d009 < e441db07f208184e0466abf44b389a81d70c340e`
- `Linux >= 55482edc25f0606851de42e73618f813f310d009 < 896f1a2493b59beb2b5ccdf990503dbb16cb2256`
- `Linux 4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.