CVE-2025-38264

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38264", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.997Z", "datePublished": "2025-07-09T10:42:38.602Z", "dateUpdated": "2026-10-21T12:36:54.626Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:36:54.626Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: sanitize request list handling\n\nValidate the request in nvme_tcp_handle_r2t() to ensure it's not part of\nany list, otherwise a malicious R2T PDU might inject a loop in request\nlist processing."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is the NVMe-over-TCP host driver's PDU receive path, parsing an R2T PDU sent by a remote NVMe-oF target over TCP (port 4420); the malicious input arrives purely over the network from a compromised/rogue target or an on-path attacker.\nAC:L - The target fully controls PDU content and timing \u2014 placing two R2T PDUs for the same command_id in a single TCP segment guarantees both are processed inside one nvme_tcp_recv_skb() pass with no send-path progress between them, creating the llist cycle deterministically with no race to win and no memory-layout dependency.\nPR:N - NVMe/TCP requires no authentication by default (TLS and DH-HMAC-CHAP are optional, off in stock configs), so the remote peer needs zero privileges or credentials on the victim host \u2014 it simply answers I/O it is already being sent.\nUI:N - No victim action is required; once the host is connected to the target, ordinary filesystem/block I/O generates the in-flight commands and the malicious target triggers the bug on its own by replying with duplicate R2T PDUs.\nS:U - The corruption and the resulting hang are confined to the host kernel's own memory and scheduling authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Beyond the list corruption, duplicate queueing lets the RX path reset req->state/offset/pdu_len while the TX path is consuming the request, desynchronizing req->iter so nvme_tcp_req_cur_page() reads past the bvec array and sock_sendmsg() splices unintended kernel pages directly to the attacker-controlled socket.\nI:H - Attacker-controlled input produces kernel linked-list pointer corruption (double llist_add plus repeated list_add of an already-linked entry into send_list) and lets an in-flight request's PDU header, ttag, and iterator state be rewritten mid-transfer, which is memory/state corruption leverageable for further control over kernel structures.\nA:H - The injected cycle makes nvme_tcp_process_req_list() spin forever in the nvme_tcp_wq kworker while holding queue->send_mutex with no cond_resched(), producing a CPU soft lockup, RCU stalls, and a permanently wedged storage queue \u2014 a deterministic, unauthenticated remote kernel hang."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/tcp.c"], "versions": [{"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "8f27d152b2a59f443091cf9e3d815f06e32e9b96", "status": "affected", "versionType": "git"}, {"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "78a4adcd3fedb0728436e8094848ebf4c6bae006", "status": "affected", "versionType": "git"}, {"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "f054ea62598197714a6ca7b3b387a027308f8b13", "status": "affected", "versionType": "git"}, {"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "0bf04c874fcb1ae46a863034296e4b33d8fbd66c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/tcp.c"], "versions": [{"version": "5.0", "status": "affected"}, {"version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.36", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.5", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.15.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8f27d152b2a59f443091cf9e3d815f06e32e9b96"}, {"url": "https://git.kernel.org/stable/c/78a4adcd3fedb0728436e8094848ebf4c6bae006"}, {"url": "https://git.kernel.org/stable/c/f054ea62598197714a6ca7b3b387a027308f8b13"}, {"url": "https://git.kernel.org/stable/c/0bf04c874fcb1ae46a863034296e4b33d8fbd66c"}], "title": "nvme-tcp: sanitize request list handling", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8f27d152b2a59f443091cf9e3d815f06e32e9b96", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}, {"lessThan": "78a4adcd3fedb0728436e8094848ebf4c6bae006", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}, {"lessThan": "f054ea62598197714a6ca7b3b387a027308f8b13", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}, {"lessThan": "0bf04c874fcb1ae46a863034296e4b33d8fbd66c", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.36", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A758CD7A-5A7A-490D-922C-0C9DC4947E5E", "versionEndExcluding": "6.12.36", "versionStartIncluding": "5.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CC768E2-3BBC-4A6E-9C2F-ECB27A703C2D", "versionEndExcluding": "6.15.5", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: sanitize request list handling\n\nValidate the request in nvme_tcp_handle_r2t() to ensure it's not part of\nany list, otherwise a malicious R2T PDU might inject a loop in request\nlist processing."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-tcp: desinfectar el manejo de la lista de solicitudes Valide la solicitud en nvme_tcp_handle_r2t() para asegurarse de que no sea parte de ninguna lista; de lo contrario, una PDU R2T maliciosa podr\u00eda inyectar un bucle en el procesamiento de la lista de solicitudes."}], "id": "CVE-2025-38264", "lastModified": "2026-10-21T13:18:10.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-07-09T11:15:28.810", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0bf04c874fcb1ae46a863034296e4b33d8fbd66c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/78a4adcd3fedb0728436e8094848ebf4c6bae006"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8f27d152b2a59f443091cf9e3d815f06e32e9b96"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f054ea62598197714a6ca7b3b387a027308f8b13"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nvme-tcp: sanitize request list handling", "id": "2378996", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2378996"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38264", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38264\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38264\nhttps://lore.kernel.org/linux-cve-announce/2025070937-CVE-2025-38264-ffd2@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T21:08:09.729063+00:00", "updated": "2025-07-13T21:08:09.729208+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}