CVE-2025-38658: nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails
In the Linux kernel, the following vulnerability has been resolved:
nvmet: pci-epf: Do not complete commands twice if nvmetreqinit() fails
Have nvmetreqinit() and req->execute() complete failed commands.
Description of the problem: nvmetreqinit() calls nvmetreqcomplete() internally upon failure, e.g., unsupported opcode, which calls the "queueresponse" callback, this results in nvmetpciepfqueueresponse() being called, which will call nvmetpciepfcompleteiod() if datalen is 0 or if dmadir is different from DMATODEVICE. This results in a double completion as nvmetpciepfexeciodwork() also calls nvmetpciepfcompleteiod() when nvmetreqinit() fails.
Steps to reproduce: On the host send a command with an unsupported opcode with nvme-cli, For example the admin command "security receive" $ sudo nvme security-recv /dev/nvme0n1 -n1 -x4096
This triggers a double completion as nvmetreqinit() fails and nvmetpciepfqueueresponse() is called, here iod->dmadir is still in the default state of "DMANONE" as set by default in nvmetpciepfallociod(), so nvmetpciepfcompleteiod() is called. Because nvmetreqinit() failed nvmetpciepfcompleteiod() is also called in nvmetpciepfexeciodwork() leading to a double completion. This not only sends two completions to the host but also corrupts the state of the PCI NVMe target leading to kernel oops.
This patch lets nvmetreqinit() and req->execute() complete all failed commands, and removes the double completion case in nvmetpciepfexeciodwork() therefore fixing the edge cases where double completions occurred.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel nvmet: pci-epfto a version that resolves this vulnerability.Patch nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails - Compensating control
If your environment is impacted, avoid issuing NVMe Admin commands such as 'security receive' with unsupported opcodes to the host via nvme-cli, since the described vulnerability is triggered by sending a command with an unsupported opcode.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38658?
CVE-2025-38658 has been classified with a moderate severity level due to its impact on command completion in the nvmet subsystem of the Linux kernel.
How do I fix CVE-2025-38658?
To fix CVE-2025-38658, update your Linux kernel to the latest version where the vulnerability has been addressed.
What systems are affected by CVE-2025-38658?
CVE-2025-38658 affects all versions of the Linux kernel that implement the nvmet functionality.
What could happen if CVE-2025-38658 is exploited?
An exploit of CVE-2025-38658 could result in improper command handling, potentially leading to system instability.
When was CVE-2025-38658 discovered?
CVE-2025-38658 was discovered and documented as part of ongoing vulnerability assessments within the Linux kernel development process.