Riskcovery

CVE-2025-38405

nvmet: fix memory leak of bio integrity

State
Published
Severity
7.5 High
Published
Jul 25, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix memory leak of bio integrity

If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity.

Since commit bf4c89fc8797 ("block: don't call bio_uninit from bio_endio") each user of bio_init has to use bio_uninit as well. Otherwise the bio integrity is not getting free. Nvmet uses bio_init for inline bios.

Uninit the inline bio to complete deallocation of integrity in bio.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f to before 431e58d56fcb5ff1f9eb630724a922e0d2a941dfAffected
  • bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f to before 2e2028fcf924d1c6df017033c8d6e28b735a0508Affected
  • bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f to before 190f4c2c863af7cc5bb354b70e0805f06419c038Affected
  • 64149da0fddbbfe43e11c0348d8c8b4171dae3a2Affected
  • 6.10.10 to before 6.11Affected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.12.37 through 6.12.*Not affected
  • 6.15.6 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.