by Kastro
Paper/Archive/CVE-2025-38264

CVE-2025-38264

Linux Linux — nvme-tcp: sanitize request list handling

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 38.8.388 × 207.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list processing.

Affected

ProductAffectedFixed inSource
Linux3f2304f8c6d6ed97849057bd16fee99e434ca796 – < 8f27d152b2a59f443091cf9e3d815f06e32e9b968f27d152b2a59f443091cf9e3d815f06e32e9b96CNA
Linux3f2304f8c6d6ed97849057bd16fee99e434ca796 – < 78a4adcd3fedb0728436e8094848ebf4c6bae00678a4adcd3fedb0728436e8094848ebf4c6bae006CNA
Linux3f2304f8c6d6ed97849057bd16fee99e434ca796 – < f054ea62598197714a6ca7b3b387a027308f8b13f054ea62598197714a6ca7b3b387a027308f8b13CNA
Linux3f2304f8c6d6ed97849057bd16fee99e434ca796 – < 0bf04c874fcb1ae46a863034296e4b33d8fbd66c0bf04c874fcb1ae46a863034296e4b33d8fbd66cCNA
Linux5.0–CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgit.kernel.org/stable/c/8f27d152b2a59f443091cf9e3d815f06e32e9b96refgit.kernel.org/stable/c/78a4adcd3fedb0728436e8094848ebf4c6bae006refgit.kernel.org/stable/c/f054ea62598197714a6ca7b3b387a027308f8b13refgit.kernel.org/stable/c/0bf04c874fcb1ae46a863034296e4b33d8fbd66c