CVE-2025-21927

nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

State: Published
Severity: 9.8 Critical
Published: Apr 1, 2025
Updated: Oct 30, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst() to access memory outside the allocated area and cause memory corruptions by overwriting it with the calculated digest.

Fix this by rejecting packets with an unexpected header length.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
LinuxLinux	3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 3b54109b2f771f74fd53b027429796326f84ab36Affected 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 9d22cf5cc94cd7dee84773ec41db78a46107dfa3Affected 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 9fbc953d6b38bc824392e01850f0aeee3b348722Affected 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126Affected 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before ad95bab0cd28ed77c2c0d0b6e76e03e031391064Affected
LinuxLinux	5.0Affected before 5.0Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.19 through 6.12.Not affected 6.13.7 through 6.13.Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 3b54109b2f771f74fd53b027429796326f84ab36Affected
3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 9d22cf5cc94cd7dee84773ec41db78a46107dfa3Affected
3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 9fbc953d6b38bc824392e01850f0aeee3b348722Affected
3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126Affected
3f2304f8c6d6ed97849057bd16fee99e434ca796 to before ad95bab0cd28ed77c2c0d0b6e76e03e031391064Affected

LinuxLinux

5.0Affected
before 5.0Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.19 through 6.12.*Not affected
6.13.7 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.