CVE-2025-38658: nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails

Published Aug 22, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

nvmet: pci-epf: Do not complete commands twice if nvmetreqinit() fails

Have nvmetreqinit() and req->execute() complete failed commands.

Description of the problem: nvmetreqinit() calls nvmetreqcomplete() internally upon failure, e.g., unsupported opcode, which calls the "queueresponse" callback, this results in nvmetpciepfqueueresponse() being called, which will call nvmetpciepfcompleteiod() if datalen is 0 or if dmadir is different from DMATODEVICE. This results in a double completion as nvmetpciepfexeciodwork() also calls nvmetpciepfcompleteiod() when nvmetreqinit() fails.

Steps to reproduce: On the host send a command with an unsupported opcode with nvme-cli, For example the admin command "security receive" $ sudo nvme security-recv /dev/nvme0n1 -n1 -x4096

This triggers a double completion as nvmetreqinit() fails and nvmetpciepfqueueresponse() is called, here iod->dmadir is still in the default state of "DMANONE" as set by default in nvmetpciepfallociod(), so nvmetpciepfcompleteiod() is called. Because nvmetreqinit() failed nvmetpciepfcompleteiod() is also called in nvmetpciepfexeciodwork() leading to a double completion. This not only sends two completions to the host but also corrupts the state of the PCI NVMe target leading to kernel oops.

This patch lets nvmetreqinit() and req->execute() complete all failed commands, and removes the double completion case in nvmetpciepfexeciodwork() therefore fixing the edge cases where double completions occurred.

Affected Software

2 affected components
Linux Linux kernel=
Linux Linux kernel>=6.14<6.16.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Linux kernel nvmet: pci-epf to a version that resolves this vulnerability.

    Patch nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails
  2. Compensating control

    If your environment is impacted, avoid issuing NVMe Admin commands such as 'security receive' with unsupported opcodes to the host via nvme-cli, since the described vulnerability is triggered by sending a command with an unsupported opcode.

Event History

Aug 22, 2025
CVE Published
via MITRE·04:01 PM
Data Sourced
via MITRE·04:01 PM
DescriptionSeverity
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-38658?

CVE-2025-38658 has been classified with a moderate severity level due to its impact on command completion in the nvmet subsystem of the Linux kernel.

2

How do I fix CVE-2025-38658?

To fix CVE-2025-38658, update your Linux kernel to the latest version where the vulnerability has been addressed.

3

What systems are affected by CVE-2025-38658?

CVE-2025-38658 affects all versions of the Linux kernel that implement the nvmet functionality.

4

What could happen if CVE-2025-38658 is exploited?

An exploit of CVE-2025-38658 could result in improper command handling, potentially leading to system instability.

5

When was CVE-2025-38658 discovered?

CVE-2025-38658 was discovered and documented as part of ongoing vulnerability assessments within the Linux kernel development process.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203