DEBIAN-CVE-2025-40252

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2025-40252
Published: 04 Dec 2025, 16:16
Last modified:28 Apr 2026, 20:30

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Dec 2025, 16:16
Published
Vulnerability first disclosed
28 Apr 2026, 20:30
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array. Add an explicit bound check using ARRAY_SIZE() in both loops to prevent a potential out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected Systems

  • debian•linux

    all | < 6.1.159-1 | < 6.12.63-1 | < 6.17.10-1

  • debian•linux-6.1

    < 6.1.159-1~deb11u1

References (1)