CVE-2025-38264: nvme-tcp: sanitize request list handling
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: sanitize request list handling
Validate the request in nvmetcphandler2t() to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list processing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38264?
CVE-2025-38264 has been classified as a high severity vulnerability due to its potential to lead to infinite loops in request list processing.
How do I fix CVE-2025-38264?
To fix CVE-2025-38264, ensure that you update to the latest stable version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2025-38264?
CVE-2025-38264 affects systems running the Linux kernel that utilize the NVMe over TCP protocol.
What are the consequences of not addressing CVE-2025-38264?
Failing to address CVE-2025-38264 may result in denial of service due to potential infinite loops during the request processing.
Is CVE-2025-38264 remotely exploitable?
Yes, CVE-2025-38264 can be exploited remotely through crafted R2T PDUs targeting vulnerable systems.