CVE-2025-40252: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40252 is an out-of-bounds read vulnerability in the Linux kernel's QLogic qede network driver, specifically in the qede_tpa_cont() and qede_tpa_end() functions. The flaw was discovered by the Linux Verification Center (linuxtesting.org) using the SVACE static analysis tool and disclosed on December 4, 2025. It affects Linux kernel versions from 4.6 up to the patched releases (6.6.118, 6.12.60, 6.17.10, and 6.18), as well as Microsoft Azure Linux 3 kernel packages azl3_kernel_6.6.112.1-2 and azl3_kernel_6.6.117.1-1. The CVSS v3.1 base score is 6.1 (Medium) (Feedly, Microsoft MSRC).

The root cause is a missing bounds check (CWE-125: Out-of-bounds Read) in the packet processing loops within qede_tpa_cont() and qede_tpa_end() in the qede driver. These loops iterate over the fixed-size array cqe->len_list[] using only a zero-length entry as a terminator; if the terminator is absent or malformed — for example, due to a crafted or corrupted completion queue entry (CQE) from the network hardware — the loop can read past the end of the array. The fix adds an explicit upper-bound check using ARRAY_SIZE() in both loops. The attack vector is local, requires low privileges, and no user interaction, making it exploitable by any unprivileged local user on an affected system with a QLogic qede NIC (Feedly, Microsoft MSRC).

A low-privileged local attacker could trigger the out-of-bounds read, potentially leading to limited information disclosure (reading adjacent kernel memory) and, more significantly, system instability or a kernel crash resulting in denial of service. The high availability impact reflects the risk of kernel panics caused by invalid memory accesses in the network driver's packet processing path. Confidentiality impact is limited (low), and there is no integrity impact, so the vulnerability does not directly enable privilege escalation or data modification (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, limiting the practical attack surface to users with shell access on systems equipped with QLogic qede network adapters (Feedly).

The recommended remediation is to update to a patched Linux kernel version: 6.6.118, 6.12.60, 6.17.10, or 6.18 (mainline). Patches are available via the stable kernel git tree at the following commits: f0923011, 917a9d02, e441db07, and 896f1a24. Downstream distributions including Ubuntu (USN-8096-x, USN-8094-x, USN-8152-1), Debian (DLA-4436-1), Red Hat (RHSA-2026:13577, RHSA-2026:13578), AlmaLinux (ALSA-2026-13577, ALSA-2026-13578), and Oracle Linux have released updated kernel packages. Microsoft has also patched affected Azure Linux 3 kernel packages. As a workaround where patching is not immediately possible, restricting local user access to systems with QLogic qede NICs reduces exposure (Feedly, Microsoft MSRC, Ubuntu USN-8096-1, Red Hat).