Riskcovery

CVE-2025-38264

nvme-tcp: sanitize request list handling

State
Published
Severity
9.8 Critical
Published
Jul 9, 2025
Updated
Oct 21, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: sanitize request list handling

Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list processing.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 8f27d152b2a59f443091cf9e3d815f06e32e9b96Affected
  • 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 78a4adcd3fedb0728436e8094848ebf4c6bae006Affected
  • 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before f054ea62598197714a6ca7b3b387a027308f8b13Affected
  • 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 0bf04c874fcb1ae46a863034296e4b33d8fbd66cAffected
LinuxLinux
  • 5.0Affected
  • before 5.0Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.36 through 6.12.*Not affected
  • 6.15.5 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.