CVE-2025-68265

nvme: fix admin request_queue lifetime

Published Dec 16, 2025 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix admin request_queue lifetime

The namespaces can access the controller's admin request_queue, and
stale references on the namespaces may exist after tearing down the
controller. Ensure the admin request_queue is active by moving the
controller's 'put' to after all controller references have been released
to ensure no one is can access the request_queue. This fixes a reported
use-after-free bug:

BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0
Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287
CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15
Tainted: [E]=UNSIGNED_MODULE
Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025
Call Trace:
<TASK>
dump_stack_lvl+0x4f/0x60
print_report+0xc4/0x620
? _raw_spin_lock_irqsave+0x70/0xb0
? _raw_read_unlock_irqrestore+0x30/0x30
? blk_queue_enter+0x41c/0x4a0
kasan_report+0xab/0xe0
? blk_queue_enter+0x41c/0x4a0
blk_queue_enter+0x41c/0x4a0
? __irq_work_queue_local+0x75/0x1d0
? blk_queue_start_drain+0x70/0x70
? irq_work_queue+0x18/0x20
? vprintk_emit.part.0+0x1cc/0x350
? wake_up_klogd_work_func+0x60/0x60
blk_mq_alloc_request+0x2b7/0x6b0
? __blk_mq_alloc_requests+0x1060/0x1060
? __switch_to+0x5b7/0x1060
nvme_submit_user_cmd+0xa9/0x330
nvme_user_cmd.isra.0+0x240/0x3f0
? force_sigsegv+0xe0/0xe0
? nvme_user_cmd64+0x400/0x400
? vfs_fileattr_set+0x9b0/0x9b0
? cgroup_update_frozen_flag+0x24/0x1c0
? cgroup_leave_frozen+0x204/0x330
? nvme_ioctl+0x7c/0x2c0
blkdev_ioctl+0x1a8/0x4d0
? blkdev_common_ioctl+0x1930/0x1930
? fdget+0x54/0x380
__x64_sys_ioctl+0x129/0x190
do_syscall_64+0x5b/0x160
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f765f703b0b
Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b
RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000
R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003
R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60
</TASK>

Analysis

Technical impact

The vulnerability is a classic use‑after‑free in the Linux NVMe driver. It occurs when a namespace resolves a stale reference to the controller’s admin request_queue after the controller has been torn down. An attacker or corrupted user space process that can trigger the stale reference can read or corrupt kernel memory, potentially resulting in a system crash or an escalation of privileges.

Affected Systems

The flaw exists in the Linux kernel NVMe driver across all kernel versions that have not incorporated the commit that moves the controller ‘put’ operation after all controller references are released. The patch is present in the latest kernel releases from the commit series referenced in the advisory (e.g., latest 6.13 series and later). Linux distributions that ship older kernel packages are therefore affected.

Risk and Exploitability

The CVSS base score of 7.8 indicates a high severity vulnerability, and the EPSS score of less than 1% indicates a low probability of exploitation. The flaw remains a local kernel bug that requires an attacker to interact with the NVMe subsystem; it is not listed in the CISA KEV catalog. In practice, the risk to production systems is limited unless the attacker can trigger the bad path, for example by sending crafted NVMe commands or by manipulating the controller lifecycle. Systems running unpatched kernels should prioritize a kernel upgrade to remove the use‑after‑free potential.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fe60e8c534118a288cd251a59d747cbf5c03e160`	affected	< 4896491c497226022626c3acc46044fd182f943c
`fe60e8c534118a288cd251a59d747cbf5c03e160`	affected	< a505f0ba36ab24176c300d7ff56aff85c2977e6c
`fe60e8c534118a288cd251a59d747cbf5c03e160`	affected	< e8061d02b49c5c901980f58d91e96580e9a14acf
`fe60e8c534118a288cd251a59d747cbf5c03e160`	affected	< e7dac681790556c131854b97551337aa8042215b
`fe60e8c534118a288cd251a59d747cbf5c03e160`	affected	< 03b3bcd319b3ab5182bc9aaa0421351572c78ac0

Linux

affected

Version	Status	Constraints
`6.1`	affected	—
`0`	unaffected	< 6.1
`6.1.168`	unaffected	≤ 6.1.*
`6.6.120`	unaffected	≤ 6.6.*
`6.12.62`	unaffected	≤ 6.12.*
`6.17.12`	unaffected	≤ 6.17.*
`6.18`	unaffected	≤ *

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the NVDev admin request_queue lifetime fix, such as the latest release from your distribution’s repository or by applying the relevant commit from the kernel tree.
If an immediate kernel upgrade is not possible, consider disabling the NVMe kernel module or restricting user access to NVMe ioctls (e.g., by removing the device from the /dev namespace or using device access control lists) until a patched kernel is available.
Continuously monitor kernel logs for KASAN or Oops messages related to NVMe and configure alerting for any such events to detect attempts to exploit the bug.

Generated by OpenCVE AI on August 5, 2026 at 03:17 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6243-1	linux security update
Ubuntu USN	USN-8094-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8094-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8094-3	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8094-4	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8094-5	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8152-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8179-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8184-1	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8179-2	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8185-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8179-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8203-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8204-1	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8185-2	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-8179-4	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8258-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8260-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8261-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8265-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8440-1	Linux kernel (Azure) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.157% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html
https://git.kernel.org/stable/c/03b3bcd319b3ab5182bc9aaa0421351572c78ac0
https://git.kernel.org/stable/c/4896491c497226022626c3acc46044fd182f943c
https://git.kernel.org/stable/c/a505f0ba36ab24176c300d7ff56aff85c2977e6c
https://git.kernel.org/stable/c/e7dac681790556c131854b97551337aa8042215b
https://git.kernel.org/stable/c/e8061d02b49c5c901980f58d91e96580e9a14acf
https://lore.kernel.org/linux-cve-announce/2025121609-CVE-2025-68265-4800@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-68265
https://www.cve.org/CVERecord?id=CVE-2025-68265

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Aug 5, 2026 3:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Aug 4, 2026 9:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Jul 30, 2026 6:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Apr 20, 2026 6:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Apr 11, 2026 1:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://git.kernel.org/stable/c/ff037b5f47eeccc1636c03f84cd47db094eb73c9

Apr 11, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4896491c497226022626c3acc46044fd182f943c

Mar 25, 2026 10:45 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/ff037b5f47eeccc1636c03f84cd47db094eb73c9

Jan 11, 2026 4:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/a505f0ba36ab24176c300d7ff56aff85c2977e6c

Dec 17, 2025 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025121609-CVE-2025-68265-4800@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-68265 https://www.cve.org/CVERecord?id=CVE-2025-68265
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Dec 16, 2025 3:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin request_queue lifetime The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug: BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted: [E]=UNSIGNED_MODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace: <TASK> dump_stack_lvl+0x4f/0x60 print_report+0xc4/0x620 ? _raw_spin_lock_irqsave+0x70/0xb0 ? _raw_read_unlock_irqrestore+0x30/0x30 ? blk_queue_enter+0x41c/0x4a0 kasan_report+0xab/0xe0 ? blk_queue_enter+0x41c/0x4a0 blk_queue_enter+0x41c/0x4a0 ? __irq_work_queue_local+0x75/0x1d0 ? blk_queue_start_drain+0x70/0x70 ? irq_work_queue+0x18/0x20 ? vprintk_emit.part.0+0x1cc/0x350 ? wake_up_klogd_work_func+0x60/0x60 blk_mq_alloc_request+0x2b7/0x6b0 ? __blk_mq_alloc_requests+0x1060/0x1060 ? __switch_to+0x5b7/0x1060 nvme_submit_user_cmd+0xa9/0x330 nvme_user_cmd.isra.0+0x240/0x3f0 ? force_sigsegv+0xe0/0xe0 ? nvme_user_cmd64+0x400/0x400 ? vfs_fileattr_set+0x9b0/0x9b0 ? cgroup_update_frozen_flag+0x24/0x1c0 ? cgroup_leave_frozen+0x204/0x330 ? nvme_ioctl+0x7c/0x2c0 blkdev_ioctl+0x1a8/0x4d0 ? blkdev_common_ioctl+0x1930/0x1930 ? fdget+0x54/0x380 __x64_sys_ioctl+0x129/0x190 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 </TASK>
Title		nvme: fix admin request_queue lifetime
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/03b3bcd319b3ab5182bc9aaa0421351572c78ac0 https://git.kernel.org/stable/c/e7dac681790556c131854b97551337aa8042215b https://git.kernel.org/stable/c/e8061d02b49c5c901980f58d91e96580e9a14acf