GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40172 (GCVE-0-2025-40172)

Vulnerability from cvelistv5 – Published: 2025-11-12 10:53 – Updated: 2026-08-05 12:08
VLAI
Title
accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()
Summary
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() Currently, if find_and_map_user_pages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host receives QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size is equal to the requested transaction size, the function will return 0 before allocating an sgt or setting the fields of the dma_xfer struct. In that case, encode_addr_size_pairs() will try to access the sgt which will lead to a general protection fault. Return an EINVAL in case the user provides a zero-sized ALP, or the device requests continuation after all of the bytes have been transferred.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 96d3c1cadedb6ae2e8965e19cd12caa244afbd9c , < 48b1d42286bfef7628b1d6c8c28d4e456c90f725 (git)
Affected: 96d3c1cadedb6ae2e8965e19cd12caa244afbd9c , < 551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede (git)
Affected: 96d3c1cadedb6ae2e8965e19cd12caa244afbd9c , < 1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6 (git)
Affected: 96d3c1cadedb6ae2e8965e19cd12caa244afbd9c , < 11f08c30a3e4157305ba692f1d44cca5fc9a8fca (git)
Affected: d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3 (git)
Affected: 6.4.12 , < 6.5 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.114 , ≤ 6.6.* (semver)
Unaffected: 6.12.55 , ≤ 6.12.* (semver)
Unaffected: 6.17.5 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/qaic/qaic_control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48b1d42286bfef7628b1d6c8c28d4e456c90f725",
              "status": "affected",
              "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
              "versionType": "git"
            },
            {
              "lessThan": "551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede",
              "status": "affected",
              "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
              "versionType": "git"
            },
            {
              "lessThan": "1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6",
              "status": "affected",
              "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
              "versionType": "git"
            },
            {
              "lessThan": "11f08c30a3e4157305ba692f1d44cca5fc9a8fca",
              "status": "affected",
              "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3",
              "versionType": "git"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/qaic/qaic_control.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()\n\nCurrently, if find_and_map_user_pages() takes a DMA xfer request from the\nuser with a length field set to 0, or in a rare case, the host receives\nQAIC_TRANS_DMA_XFER_CONT from the device where resources-\u003exferred_dma_size\nis equal to the requested transaction size, the function will return 0\nbefore allocating an sgt or setting the fields of the dma_xfer struct.\nIn that case, encode_addr_size_pairs() will try to access the sgt which\nwill lead to a general protection fault.\n\nReturn an EINVAL in case the user provides a zero-sized ALP, or the device\nrequests continuation after all of the bytes have been transferred."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the DRM_IOCTL_QAIC_MANAGE ioctl on the local accel character device /dev/accel/accelN, requiring local system access. There is no network-facing path into qaic_manage_ioctl().\nAC:L - A single ioctl carrying a QAIC_TRANS_DMA_XFER_FROM_USR transaction with the user-controlled size field set to 0 deterministically makes find_and_map_user_pages() return 0 with xfer-\u003esgt/page_list/nr_pages uninitialized; no race and no attacker-independent condition is involved. Grooming the kmalloc-64 slab so the stale sgt is a usable pointer is fully under attacker control via a preceding legitimate DMA xfer.\nPR:L - The QAIC_MANAGE ioctl is registered with flags 0 \u2014 no DRM_ROOT_ONLY, no CAP_SYS_ADMIN, and no DRM_AUTH check \u2014 so any unprivileged process able to open the accel node (the normal case for inference/compute workloads and containers on AIC100 hosts) can trigger it. No capability is verified anywhere along encode_message() \u2192 encode_dma() \u2192 find_and_map_user_pages().\nUI:N - The attacker issues the ioctl directly from their own process; no victim action, mount, or file open is needed.\nS:U - The uninitialized-pointer use and resulting corruption occur within the kernel\u0027s own security authority, the same authority the attacker escalates into. No VM, IOMMU, or sandbox boundary is crossed as a required part of the impact.\nC:H - Using uninitialized heap memory as a struct sg_table pointer causes reads of arbitrary kernel memory via sgt-\u003enents and the sg walk, and those harvested sg_dma_address/sg_dma_len values are encoded into the message sent to the accelerator, disclosing kernel-controlled DMA addresses off-host to the device. The resulting stale-pointer/double-free state is a general heap corruption primitive leveragable for arbitrary read.\nI:H - free_dma_xfers() unconditionally performs dma_unmap_sgtable(), sg_free_table(), kfree() on the uninitialized sgt and put_page()/kfree() over the uninitialized page_list and nr_pages, yielding arbitrary/double free and page refcount underflow on attacker-groomed pointers. Combined with feeding attacker-influenced addresses to the device\u0027s DMA engine, this is exploitable for arbitrary write and control-flow hijack.\nA:H - The commit itself documents that encode_addr_size_pairs() dereferences the unset sgt and produces a general protection fault, i.e. a kernel oops/panic, and it is triggerable repeatedly by any local user with device access. The double-free and page refcount corruption paths cause further fatal kernel faults."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:17.861Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48b1d42286bfef7628b1d6c8c28d4e456c90f725"
        },
        {
          "url": "https://git.kernel.org/stable/c/551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/11f08c30a3e4157305ba692f1d44cca5fc9a8fca"
        }
      ],
      "title": "accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40172",
    "datePublished": "2025-11-12T10:53:49.245Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-08-05T12:08:17.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40172",
      "date": "2026-09-19",
      "epss": "0.00142",
      "percentile": "0.03925"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/accel/qaic/qaic_control.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "48b1d42286bfef7628b1d6c8c28d4e456c90f725",
                    "status": "affected",
                    "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede",
                    "status": "affected",
                    "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6",
                    "status": "affected",
                    "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "11f08c30a3e4157305ba692f1d44cca5fc9a8fca",
                    "status": "affected",
                    "version": "96d3c1cadedb6ae2e8965e19cd12caa244afbd9c",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.5",
                    "status": "affected",
                    "version": "6.4.12",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/accel/qaic/qaic_control.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.5"
                  },
                  {
                    "lessThan": "6.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.114",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()\n\nCurrently, if find_and_map_user_pages() takes a DMA xfer request from the\nuser with a length field set to 0, or in a rare case, the host receives\nQAIC_TRANS_DMA_XFER_CONT from the device where resources-\u003exferred_dma_size\nis equal to the requested transaction size, the function will return 0\nbefore allocating an sgt or setting the fields of the dma_xfer struct.\nIn that case, encode_addr_size_pairs() will try to access the sgt which\nwill lead to a general protection fault.\n\nReturn an EINVAL in case the user provides a zero-sized ALP, or the device\nrequests continuation after all of the bytes have been transferred."
          }
        ],
        "id": "CVE-2025-40172",
        "lastModified": "2026-07-30T06:24:15.940",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-11-12T11:15:47.643",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/11f08c30a3e4157305ba692f1d44cca5fc9a8fca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1ab9733d14cc9987cc5dcd1f0ad1f416e302e2e6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/48b1d42286bfef7628b1d6c8c28d4e456c90f725"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/551f1dfbcb7f3e6ed07f9d6c8c1c64337fcd0ede"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:15:12+00:00",
      "cve": "CVE-2025-40172",
      "id": "CVE-2025-40172",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40172.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:15:22Z",
      "cve": "CVE-2025-40172",
      "id": "CVE-2025-40172",
      "initial_release_date": "2025-11-14T00:24:22Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "382",
      "product_status:recommended": "464",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40172",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40172.json",
      "version": "37"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.