The Linux kernel vulnerability CVE-2025-40252 affects the qlogic/qede network driver. Specifically, the functions qede_tpa_cont() and qede_tpa_end() iterate over the cqe->len_list[] array relying solely on a zero-length terminator to end the loop. If this terminator is absent or malformed, the loops may read beyond the fixed-size array boundary, causing out-of-bounds memory access. The issue was identified by the Linux Verification Center using SVACE analysis. The patch introduces explicit boundary checks with ARRAY_SIZE() to prevent this out-of-bounds read condition.

Successful exploitation could result in out-of-bounds memory reads, potentially leading to information disclosure, system instability, or denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability, classifying this as a critical severity vulnerability.

A fix has been implemented in the Linux kernel to add explicit boundary checks in the affected functions. Users and administrators should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Since no specific patch links or vendor advisories are provided, verify the kernel version and update accordingly when the fix is available. Patch status is not yet confirmed in this data; check the official Linux kernel advisories for current remediation guidance.