CVE-2025-22118: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-22118 is a vulnerability discovered in the Linux kernel, specifically affecting the ice (Intel® Ethernet Controller) driver component. The vulnerability was disclosed on April 16, 2025, and involves issues with queue quanta parameters that could lead to out-of-bounds access. The vulnerability affects various Linux distributions and their kernel implementations (NVD, Ubuntu).

The vulnerability stems from improper validation of queue quanta parameters in the ice driver, which could potentially lead to out-of-bounds access. The issue specifically relates to queue wraparound prevention in quanta configuration, where end_qid could overflow due to insufficient validation of start_qid and num_queues parameters. According to Red Hat's assessment, this vulnerability has been assigned a CVSS v3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

The vulnerability primarily affects system availability, as indicated by the CVSS metrics showing high impact on availability (A:H) but no impact on confidentiality (C:N) or integrity (I:N). The local attack vector and low attack complexity suggest that while the vulnerability is significant, it requires local access to exploit (Red Hat).

The vulnerability requires local access to exploit, with low attack complexity and low privileges required, as indicated by the CVSS metrics (AV:L/AC:L/PR:L). No user interaction is needed for exploitation (UI:N) (Red Hat).

The vulnerability has been resolved in the Linux kernel through patches that implement proper validation of queue quanta parameters. The fix includes adding queue wraparound prevention in quanta configuration and ensuring end_qid does not overflow by validating start_qid and num_queues (NVD).