In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: Treat remaining == 0 as error in findandmapuserpages()
Currently, if findandmapuserpages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host receives QAICTRANSDMAXFERCONT from the device where resources->xferreddmasize is equal to the requested transaction size, the function will return 0 before allocating an sgt or setting the fields of the dmaxfer struct. In that case, encodeaddrsizepairs() will try to access the sgt which will lead to a general protection fault.
Return an EINVAL in case the user provides a zero-sized ALP, or the device requests continuation after all of the bytes have been transferred.
[
{
"digest": {
"length": 1542.0,
"function_hash": "260924920305714222953711181898924101676"
},
"target": {
"file": "drivers/accel/qaic/qaic_control.c",
"function": "find_and_map_user_pages"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48b1d42286bfef7628b1d6c8c28d4e456c90f725",
"id": "CVE-2025-40172-2ef65627",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1542.0,
"function_hash": "260924920305714222953711181898924101676"
},
"target": {
"file": "drivers/accel/qaic/qaic_control.c",
"function": "find_and_map_user_pages"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede",
"id": "CVE-2025-40172-4c8c8c86",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"93129381844966329126487030217880455693",
"266370504204097593334757105966917454248",
"310910333108898628376394269638554709408",
"168730482638070787301634078262305377654"
],
"threshold": 0.9
},
"target": {
"file": "drivers/accel/qaic/qaic_control.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6",
"id": "CVE-2025-40172-7263be80",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 1542.0,
"function_hash": "260924920305714222953711181898924101676"
},
"target": {
"file": "drivers/accel/qaic/qaic_control.c",
"function": "find_and_map_user_pages"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6",
"id": "CVE-2025-40172-91b95f05",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1542.0,
"function_hash": "260924920305714222953711181898924101676"
},
"target": {
"file": "drivers/accel/qaic/qaic_control.c",
"function": "find_and_map_user_pages"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11f08c30a3e4157305ba692f1d44cca5fc9a8fca",
"id": "CVE-2025-40172-b0f6c305",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"93129381844966329126487030217880455693",
"266370504204097593334757105966917454248",
"310910333108898628376394269638554709408",
"168730482638070787301634078262305377654"
],
"threshold": 0.9
},
"target": {
"file": "drivers/accel/qaic/qaic_control.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48b1d42286bfef7628b1d6c8c28d4e456c90f725",
"id": "CVE-2025-40172-c5a7c6d8",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"93129381844966329126487030217880455693",
"266370504204097593334757105966917454248",
"310910333108898628376394269638554709408",
"168730482638070787301634078262305377654"
],
"threshold": 0.9
},
"target": {
"file": "drivers/accel/qaic/qaic_control.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11f08c30a3e4157305ba692f1d44cca5fc9a8fca",
"id": "CVE-2025-40172-ccb8ca1a",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"93129381844966329126487030217880455693",
"266370504204097593334757105966917454248",
"310910333108898628376394269638554709408",
"168730482638070787301634078262305377654"
],
"threshold": 0.9
},
"target": {
"file": "drivers/accel/qaic/qaic_control.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede",
"id": "CVE-2025-40172-e75c272c",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
}
]