Description

In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe->len_list[] Move index check before element access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:44.870Z",
  "pubdate": "2026-08-28T08:16:44.870Z",
  "executiveSummary": "The vulnerability is an out-of-bounds (OOB) memory access issue identified in the Linux kernel's qede network driver. The flaw stems from an improper sequence of operations where an array index is utilized to access cqe->len_list[] prior to validating the index bounds.\nThis vulnerability poses a significant risk to system integrity and stability. By manipulating network traffic or hardware-generated Completion Queue Entries (CQEs), an attacker could trigger a memory corruption event.\nThe impact ranges from kernel-level denial-of-service (system crashes/kernel panics) to potential arbitrary code execution or privilege escalation, depending on the attacker's ability to influence the memory layout and the specific data stored in the adjacent memory regions.\nExploitation requires an attacker to be in a position to influence the network device's input or communication with the qede driver, typically requiring local network access or control over a malicious peripheral interacting with the driver. Successful exploitation relies on the driver processing malformed CQE metadata provided by the hardware or a simulated device.",
  "technicalDetails": "The root cause of this vulnerability lies in a logic error within the qede driver's processing loop for hardware Completion Queue Entries (CQEs). Specifically, the driver logic performs an access operation on the cqe->len_list[] array before verifying that the index used for the access is within the allocated bounds of that array.\nIn the Linux kernel network stack, the qede driver handles descriptors and completion events for specific hardware interfaces. When the driver processes a CQE, it must iterate through elements or access specific indices of a length list defined in the CQE structure. The vulnerable implementation accessed the array element as a primary operation, and only performed the bounds check as a subsequent validation step.\nThis creates an out-of-bounds read and potentially an out-of-bounds write primitive. If the index value provided in the hardware-generated CQE is malicious or corrupted, the CPU reads or writes data at a memory location outside the intended buffer. Because this occurs within the kernel execution context, the memory accessed could belong to sensitive kernel structures, function pointers, or data buffers.\nThe attack flow proceeds as follows: 1) An attacker triggers or provides a malformed CQE, either through physical hardware manipulation, a malicious device simulation, or by exploiting prior vulnerabilities that allow for the injection of data into the queue. 2) The qede driver initiates the processing of this CQE. 3) The driver accesses cqe->len_list[index] using an unsanitized index. 4) The hardware/software interface proceeds with an out-of-bounds memory operation. 5) The system experiences memory corruption. If the corrupted memory contains return addresses or sensitive kernel objects, the attacker can hijack kernel control flow.\nThe vulnerability is present in the qede network driver component. Because this code resides within the kernel, the driver operates with the highest privilege levels. Authentication is not strictly a factor in the traditional sense, as this is a memory safety issue triggered by low-level driver logic; however, the attacker must have the ability to influence the driver's input processing, typically requiring an environment where they can communicate with the network interface or manipulate the underlying packet descriptor processing routines. The exposure is limited to systems utilizing the specific qede driver affected by this logic error."
}