CVE-2025-38264

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38264
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38264.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-38264
Downstream
AZL (2)
BELL (1)
DEBIAN (1)
ECHO (1)
MINI (1)
OESA (3)
openSUSE (1)
RHSA (1)
RLSA (1)
ROOT (4)
SUSE (16)
UBUNTU (1)
Related
ALSA (1)
openSUSE (1)
SUSE (16)
Published
2025-07-09T10:42:38Z
Modified
2026-10-22T02:48:50Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
nvme-tcp: sanitize request list handling
Details

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: sanitize request list handling

Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list processing.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38264.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3f2304f8c6d6ed97849057bd16fee99e434ca796
Fixed
8f27d152b2a59f443091cf9e3d815f06e32e9b96
Fixed
78a4adcd3fedb0728436e8094848ebf4c6bae006
Fixed
f054ea62598197714a6ca7b3b387a027308f8b13
Fixed
0bf04c874fcb1ae46a863034296e4b33d8fbd66c

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38264.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.36
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38264.json"