CVE-2025-40172 accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Treat remaining == 0 as error in findandmapuserpages Currently, if findandmapuserpages takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host receives QAICTRANSDMAXFERCONT fro...

CVE-2025-40172

CVE-2025-40172 is connected to the Linux kernel’s QAIC driver (drivers/accel/qaic/qaic_control.c). The issue arises in find_and_map_user_pages(): when a DMA transfer request from user space has a length of 0, or in a rare case the host/device signals QAIC_TRANS_DMA_XFER_CONT with resources->xf...