In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: Treat remaining == 0 as error in findandmapuserpages()
Currently, if findandmapuserpages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host receives QAICTRANSDMAXFERCONT from the device where resources->xferreddmasize is equal to the requested transaction size, the function will return 0 before allocating an sgt or setting the fields of the dmaxfer struct. In that case, encodeaddrsizepairs() will try to access the sgt which will lead to a general protection fault.
Return an EINVAL in case the user provides a zero-sized ALP, or the device requests continuation after all of the bytes have been transferred.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40172.json"
}