CVE-2025-22001

What it actually does

Integer overflow in qaic_validate_req() when adding u64 values supplied by user space through qaic_attach_slice_bo_ioctl() without using check_add_overflow(), allowing wraparound.

Why it matters to the business

Potential kernel memory corruption or crashes on systems using the Qualcomm AI accelerator driver; listed threat actor activity around similar kernel privilege escalations increases urgency for affected Linux environments.

How an attack unfolds

Attacker crafts malicious ioctl parameters with large u64 values that wrap when added inside qaic_validate_req(), bypassing length checks and leading to out-of-bounds operations; similar patterns observed in related kernel privilege-escalation campaigns.

How to fix it

Update the Linux kernel to a version containing the fix for CVE-2025-22001; apply the listed bind package updates where the driver is packaged (bind 32:9.11.13-6.el8_2.3 and equivalents) and reboot affected systems.

How to confirm the fix worked

Confirm kernel version includes the check_add_overflow() change in accel/qaic; verify package versions match the fixed bind releases and test ioctl paths with boundary values.

Typical attack path

1. Identify system with qaic driver loaded and accessible device nodes
2. Open /dev/qaic device and prepare qaic_attach_slice_bo_ioctl call
3. Supply crafted u64 offset and size values that trigger addition overflow
4. Trigger the ioctl to cause wraparound and subsequent invalid memory access
5. Leverage resulting corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for qaic driver errors or warnings around ioctl handling; inspect audit logs for unusual access to /dev/qaic nodes; correlate with privilege-escalation attempts noted in related CVEs.

What your security team should do

• Prioritize kernel and bind package updates on all systems exposing qaic devices due to related privilege-escalation activity
• Audit systems for qaic driver usage and restrict device access via permissions or SELinux
• Monitor EPSS trend and threat actor reports for similar kernel issues