CVE-2025-68265: nvme: fix admin request_queue lifetime
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin requestqueue lifetime
The namespaces can access the controller's admin requestqueue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin requestqueue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the requestqueue. This fixes a reported use-after-free bug:
BUG: KASAN: slab-use-after-free in blkqueueenter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted: [E]=UNSIGNEDMODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace: <TASK> dumpstacklvl+0x4f/0x60 printreport+0xc4/0x620 ? rawspinlockirqsave+0x70/0xb0 ? rawreadunlockirqrestore+0x30/0x30 ? blkqueueenter+0x41c/0x4a0 kasanreport+0xab/0xe0 ? blkqueueenter+0x41c/0x4a0 blkqueueenter+0x41c/0x4a0 ? irqworkqueuelocal+0x75/0x1d0 ? blkqueuestartdrain+0x70/0x70 ? irqworkqueue+0x18/0x20 ? vprintkemit.part.0+0x1cc/0x350 ? wakeupklogdworkfunc+0x60/0x60 blkmqallocrequest+0x2b7/0x6b0 ? blkmqallocrequests+0x1060/0x1060 ? switchto+0x5b7/0x1060 nvmesubmitusercmd+0xa9/0x330 nvmeusercmd.isra.0+0x240/0x3f0 ? forcesigsegv+0xe0/0xe0 ? nvmeusercmd64+0x400/0x400 ? vfsfileattrset+0x9b0/0x9b0 ? cgroupupdatefrozenflag+0x24/0x1c0 ? cgroupleavefrozen+0x204/0x330 ? nvmeioctl+0x7c/0x2c0 blkdevioctl+0x1a8/0x4d0 ? blkdevcommonioctl+0x1930/0x1930 ? fdget+0x54/0x380 x64sysioctl+0x129/0x190 dosyscall64+0x5b/0x160 entrySYSCALL64afterhwframe+0x4b/0x53 RIP: 0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIGRAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 </TASK>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
For the Linux kernel nvme driver, ensure the admin request_queue remains active by moving the controller's 'put' until after all controller references have been released, preventing stale namespace references from accessing the request_queue during controller teardown.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68265?
CVE-2025-68265 has been assigned a moderate severity level due to potential stability implications in the Linux kernel.
How do I fix CVE-2025-68265?
To fix CVE-2025-68265, update to the latest version of the Linux kernel that includes the fix for this vulnerability.
What is the impact of CVE-2025-68265 on affected systems?
CVE-2025-68265 may lead to stale references in the admin request queue, potentially causing system instability when the controller is torn down.
Which versions of the Linux kernel are affected by CVE-2025-68265?
CVE-2025-68265 affects certain versions of the Linux kernel, and users are advised to consult their distribution's changelog for specific details.
Is CVE-2025-68265 exploitable remotely?
CVE-2025-68265 is not directly exploitable remotely as it pertains to internal handling of the admin request queue within the Linux kernel.