{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40172","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.177Z","datePublished":"2025-11-12T10:53:49.245Z","dateUpdated":"2026-08-05T12:08:17.861Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:08:17.861Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()\n\nCurrently, if find_and_map_user_pages() takes a DMA xfer request from the\nuser with a length field set to 0, or in a rare case, the host receives\nQAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size\nis equal to the requested transaction size, the function will return 0\nbefore allocating an sgt or setting the fields of the dma_xfer struct.\nIn that case, encode_addr_size_pairs() will try to access the sgt which\nwill lead to a general protection fault.\n\nReturn an EINVAL in case the user provides a zero-sized ALP, or the device\nrequests continuation after all of the bytes have been transferred."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via the DRM_IOCTL_QAIC_MANAGE ioctl on the local accel character device /dev/accel/accelN, requiring local system access. There is no network-facing path into qaic_manage_ioctl().\nAC:L - A single ioctl carrying a QAIC_TRANS_DMA_XFER_FROM_USR transaction with the user-controlled size field set to 0 deterministically makes find_and_map_user_pages() return 0 with xfer->sgt/page_list/nr_pages uninitialized; no race and no attacker-independent condition is involved. Grooming the kmalloc-64 slab so the stale sgt is a usable pointer is fully under attacker control via a preceding legitimate DMA xfer.\nPR:L - The QAIC_MANAGE ioctl is registered with flags 0 — no DRM_ROOT_ONLY, no CAP_SYS_ADMIN, and no DRM_AUTH check — so any unprivileged process able to open the accel node (the normal case for inference/compute workloads and containers on AIC100 hosts) can trigger it. No capability is verified anywhere along encode_message() → encode_dma() → find_and_map_user_pages().\nUI:N - The attacker issues the ioctl directly from their own process; no victim action, mount, or file open is needed.\nS:U - The uninitialized-pointer use and resulting corruption occur within the kernel's own security authority, the same authority the attacker escalates into. No VM, IOMMU, or sandbox boundary is crossed as a required part of the impact.\nC:H - Using uninitialized heap memory as a struct sg_table pointer causes reads of arbitrary kernel memory via sgt->nents and the sg walk, and those harvested sg_dma_address/sg_dma_len values are encoded into the message sent to the accelerator, disclosing kernel-controlled DMA addresses off-host to the device. The resulting stale-pointer/double-free state is a general heap corruption primitive leveragable for arbitrary read.\nI:H - free_dma_xfers() unconditionally performs dma_unmap_sgtable(), sg_free_table(), kfree() on the uninitialized sgt and put_page()/kfree() over the uninitialized page_list and nr_pages, yielding arbitrary/double free and page refcount underflow on attacker-groomed pointers. Combined with feeding attacker-influenced addresses to the device's DMA engine, this is exploitable for arbitrary write and control-flow hijack.\nA:H - The commit itself documents that encode_addr_size_pairs() dereferences the unset sgt and produces a general protection fault, i.e. a kernel oops/panic, and it is triggerable repeatedly by any local user with device access. The double-free and page refcount corruption paths cause further fatal kernel faults."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/qaic/qaic_control.c"],"versions":[{"version":"96d3c1cadedb6ae2e8965e19cd12caa244afbd9c","lessThan":"48b1d42286bfef7628b1d6c8c28d4e456c90f725","status":"affected","versionType":"git"},{"version":"96d3c1cadedb6ae2e8965e19cd12caa244afbd9c","lessThan":"551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede","status":"affected","versionType":"git"},{"version":"96d3c1cadedb6ae2e8965e19cd12caa244afbd9c","lessThan":"1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6","status":"affected","versionType":"git"},{"version":"96d3c1cadedb6ae2e8965e19cd12caa244afbd9c","lessThan":"11f08c30a3e4157305ba692f1d44cca5fc9a8fca","status":"affected","versionType":"git"},{"version":"d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3","status":"affected","versionType":"git"},{"version":"6.4.12","lessThan":"6.5","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/qaic/qaic_control.c"],"versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","status":"unaffected","versionType":"semver"},{"version":"6.6.114","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.55","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.17.5","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.6.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.12.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.17.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/48b1d42286bfef7628b1d6c8c28d4e456c90f725"},{"url":"https://git.kernel.org/stable/c/551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede"},{"url":"https://git.kernel.org/stable/c/1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6"},{"url":"https://git.kernel.org/stable/c/11f08c30a3e4157305ba692f1d44cca5fc9a8fca"}],"title":"accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()","x_generator":{"engine":"bippy-1.2.0"}}}}