qede CqeLenList OOB

Vulnerability analysis

The qede driver's TCP packet aggregation path processes incoming network data using a fixed-size array of segment lengths from a hardware completion queue entry. The code checked the array element value before confirming the index was within bounds, so a malformed completion entry lacking a zero terminator caused reads beyond the array. The fix reverses this order so the bound check happens before any element access. This is reachable by an adjacent attacker sending packets to a host with a QLogic qede network adapter; no privileges or user interaction are required.