GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38405 (GCVE-0-2025-38405)

Vulnerability from cvelistv5 – Published: 2025-07-25 13:12 – Updated: 2026-08-05 12:01
VLAI
Title
nvmet: fix memory leak of bio integrity
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak of bio integrity If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity. Since commit bf4c89fc8797 ("block: don't call bio_uninit from bio_endio") each user of bio_init has to use bio_uninit as well. Otherwise the bio integrity is not getting free. Nvmet uses bio_init for inline bios. Uninit the inline bio to complete deallocation of integrity in bio.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f , < 431e58d56fcb5ff1f9eb630724a922e0d2a941df (git)
Affected: bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f , < 2e2028fcf924d1c6df017033c8d6e28b735a0508 (git)
Affected: bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f , < 190f4c2c863af7cc5bb354b70e0805f06419c038 (git)
Affected: 64149da0fddbbfe43e11c0348d8c8b4171dae3a2 (git)
Affected: 6.10.10 , < 6.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.37 , ≤ 6.12.* (semver)
Unaffected: 6.15.6 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/nvmet.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "431e58d56fcb5ff1f9eb630724a922e0d2a941df",
              "status": "affected",
              "version": "bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f",
              "versionType": "git"
            },
            {
              "lessThan": "2e2028fcf924d1c6df017033c8d6e28b735a0508",
              "status": "affected",
              "version": "bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f",
              "versionType": "git"
            },
            {
              "lessThan": "190f4c2c863af7cc5bb354b70e0805f06419c038",
              "status": "affected",
              "version": "bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "64149da0fddbbfe43e11c0348d8c8b4171dae3a2",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/nvmet.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix memory leak of bio integrity\n\nIf nvmet receives commands with metadata there is a continuous memory\nleak of kmalloc-128 slab or more precisely bio-\u003ebi_integrity.\n\nSince commit bf4c89fc8797 (\"block: don\u0027t call bio_uninit from bio_endio\")\neach user of bio_init has to use bio_uninit as well. Otherwise the bio\nintegrity is not getting free. Nvmet uses bio_init for inline bios.\n\nUninit the inline bio to complete deallocation of integrity in bio."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The leak is driven entirely by NVMe commands received by the nvmet target from a remote host, and the affected metadata/PI path is only reachable via nvmet-rdma (the sole transport setting NVMF_METADATA_SUPPORTED), which runs over routable RoCEv2/iWARP fabrics. No local access to the target is needed.\nAC:L - Every read/write command carrying protection information leaks a bip allocation with 100% reliability \u2014 no race, no memory-layout dependency, and the attacker fully controls the I/O size that selects the vulnerable inline-bio path. Repetition to exhaust memory is unconstrained.\nPR:N - NVMe-oF requires no authentication by default; the target admits hosts based on a client-supplied, trivially spoofable host NQN or with allow_any_host enabled, so an unauthenticated remote peer can establish a queue and issue I/O.\nUI:N - The leak occurs purely from processing attacker-sent NVMe I/O commands; no action by any local user or administrator is required once the target is serving.\nS:U - The leaked kernel slab memory and its consequences are confined to the kernel of the target host; no security boundary such as a hypervisor or IOMMU domain is crossed.\nC:N - The orphaned bio_integrity_payload is never re-read or exposed, and no out-of-bounds or uninitialized data is returned to the attacker, so there is no information disclosure.\nI:N - bio_init() resets bi_integrity to NULL on reuse, so the leak causes no use-after-free, double-free, or any other memory corruption \u2014 no kernel data is modified.\nA:H - The leak is unbounded and driven at line-rate I/O speed by the remote attacker, so sustained traffic exhausts kernel slab memory leading to OOM kills, allocation failures and system hang/panic on the storage target."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:38.515Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/431e58d56fcb5ff1f9eb630724a922e0d2a941df"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e2028fcf924d1c6df017033c8d6e28b735a0508"
        },
        {
          "url": "https://git.kernel.org/stable/c/190f4c2c863af7cc5bb354b70e0805f06419c038"
        }
      ],
      "title": "nvmet: fix memory leak of bio integrity",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38405",
    "datePublished": "2025-07-25T13:12:07.926Z",
    "dateReserved": "2025-04-16T04:51:24.012Z",
    "dateUpdated": "2026-08-05T12:01:38.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38405",
      "date": "2026-09-15",
      "epss": "0.00362",
      "percentile": "0.29604"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38405\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T14:15:32.077\",\"lastModified\":\"2026-07-30T06:23:12.530\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvmet: fix memory leak of bio integrity\\n\\nIf nvmet receives commands with metadata there is a continuous memory\\nleak of kmalloc-128 slab or more precisely bio-\u003ebi_integrity.\\n\\nSince commit bf4c89fc8797 (\\\"block: don\u0027t call bio_uninit from bio_endio\\\")\\neach user of bio_init has to use bio_uninit as well. Otherwise the bio\\nintegrity is not getting free. Nvmet uses bio_init for inline bios.\\n\\nUninit the inline bio to complete deallocation of integrity in bio.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvmet: se corrige una fuga de memoria de la integridad de la bio. Si nvmet recibe comandos con metadatos, se produce una fuga de memoria continua de la slab kmalloc-128 o, m\u00e1s precisamente, bio-\u0026gt;bi_integrity. Desde el commit bf4c89fc8797 (\\\"bloqueo: no llamar a bio_uninit desde bio_endio\\\"), cada usuario de bio_init debe usar tambi\u00e9n bio_uninit. De lo contrario, la integridad de la bio no se libera. nvmet usa bio_init para la bios en l\u00ednea. Desinicie la bios en l\u00ednea para completar la desasignaci\u00f3n de la integridad en la bio.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/nvme/target/nvmet.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f\",\"lessThan\":\"431e58d56fcb5ff1f9eb630724a922e0d2a941df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f\",\"lessThan\":\"2e2028fcf924d1c6df017033c8d6e28b735a0508\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf4c89fc8797f5c0964a0c3d561fbe7e8483b62f\",\"lessThan\":\"190f4c2c863af7cc5bb354b70e0805f06419c038\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"64149da0fddbbfe43e11c0348d8c8b4171dae3a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.10.10\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/nvme/target/nvmet.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.37\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.6\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.10\",\"versionEndExcluding\":\"6.12.37\",\"matchCriteriaId\":\"692DB691-91FE-43AD-82FA-92BAD9C97C80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.6\",\"matchCriteriaId\":\"6E0BB4E0-44BC-4645-83A8-6EA232CE624C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/190f4c2c863af7cc5bb354b70e0805f06419c038\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2e2028fcf924d1c6df017033c8d6e28b735a0508\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/431e58d56fcb5ff1f9eb630724a922e0d2a941df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:09:07+00:00",
      "cve": "CVE-2025-38405",
      "id": "CVE-2025-38405",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvmet: fix memory leak of bio integrity",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38405.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-03T00:14:46Z",
      "cve": "CVE-2025-38405",
      "id": "CVE-2025-38405",
      "initial_release_date": "2025-07-29T23:23:58Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "524",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38405",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38405.json",
      "version": "22"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.