CVE-2025-39949

A flaw was found in the Linux kernel QLogic QED driver related to handling protection override debug data. When collecting protection override GRC elements, the firmware may return more elements than the driver expects, causing the kernel to write past the end of a kmalloc-allocated dump buffer. This out-of-bounds write can lead to a kernel crash or potentially allow corruption of adjacent kernel memory.

This vulnerability is rated as Moderate severity because exploitation requires systems equipped with specific QLogic FastLinQ hardware and is triggered during error handling or diagnostic dump routines rather than routine network processing. Default Red Hat Enterprise Linux installations are only susceptible if relevant physical or emulated QLogic adapters are present. An abnormal firmware response during diagnostic data collection can cause an out-of-bounds memory write, leading to a local denial of service via a kernel panic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.