The Linux kernel's accel/qaic subsystem had a vulnerability where find_and_map_user_pages() did not properly handle zero-length DMA transfer requests or certain continuation conditions. This caused the function to return success without allocating the scatter-gather table (sgt) or initializing dma_xfer struct fields. As a result, encode_addr_size_pairs() would access an uninitialized sgt, causing a general protection fault. The patch changes the function to return an EINVAL error when the user provides a zero-sized ALP or when the device requests continuation after all bytes have been transferred, preventing the fault.

This vulnerability can cause a general protection fault in the Linux kernel, potentially leading to denial of service or system instability. The CVSS vector indicates local attack vector with low complexity, requiring low privileges and no user interaction, with high impact on confidentiality, integrity, and availability.

A fix has been implemented in the Linux kernel to return an error for zero-length DMA transfer requests and invalid continuation conditions. Users should apply the official kernel updates that include this patch. Patch status is not explicitly confirmed in the provided data; therefore, check the Linux kernel vendor advisory for the current remediation guidance.