{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40172","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.177Z","datePublished":"2025-11-12T10:53:49.245Z","dateUpdated":"2026-05-11T21:44:09.407Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T21:44:09.407Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()\n\nCurrently, if find_and_map_user_pages() takes a DMA xfer request from the\nuser with a length field set to 0, or in a rare case, the host receives\nQAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size\nis equal to the requested transaction size, the function will return 0\nbefore allocating an sgt or setting the fields of the dma_xfer struct.\nIn that case, encode_addr_size_pairs() will try to access the sgt which\nwill lead to a general protection fault.\n\nReturn an EINVAL in case the user provides a zero-sized ALP, or the device\nrequests continuation after all of the bytes have been transferred."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/qaic/qaic_control.c"],"versions":[{"version":"96d3c1cadedb6ae2e8965e19cd12caa244afbd9c","lessThan":"48b1d42286bfef7628b1d6c8c28d4e456c90f725","status":"affected","versionType":"git"},{"version":"96d3c1cadedb6ae2e8965e19cd12caa244afbd9c","lessThan":"551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede","status":"affected","versionType":"git"},{"version":"96d3c1cadedb6ae2e8965e19cd12caa244afbd9c","lessThan":"1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6","status":"affected","versionType":"git"},{"version":"96d3c1cadedb6ae2e8965e19cd12caa244afbd9c","lessThan":"11f08c30a3e4157305ba692f1d44cca5fc9a8fca","status":"affected","versionType":"git"},{"version":"d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/qaic/qaic_control.c"],"versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","status":"unaffected","versionType":"semver"},{"version":"6.6.114","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.55","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.17.5","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.6.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.12.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.17.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/48b1d42286bfef7628b1d6c8c28d4e456c90f725"},{"url":"https://git.kernel.org/stable/c/551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede"},{"url":"https://git.kernel.org/stable/c/1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6"},{"url":"https://git.kernel.org/stable/c/11f08c30a3e4157305ba692f1d44cca5fc9a8fca"}],"title":"accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()","x_generator":{"engine":"bippy-1.2.0"}}}}