PT-2025-34419 · Nvme-Cli+3 · Nvme-Cli+3

Published

2025-07-16

·

Updated

2025-11-25

·

CVE-2025-38658

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)
Description: The Linux kernel contains a flaw within the nvmet PCI-EPF subsystem where commands may be completed twice if nvmet req init() fails. This double completion can corrupt the state of the PCI NVMe target, potentially leading to a kernel oops. The issue occurs when an unsupported opcode is sent, such as the admin command "security receive" using nvme-cli. Specifically, the nvmet req init() function calls nvmet req complete() upon failure, which then calls nvmet pci epf queue response(). This function, under certain conditions, calls nvmet pci epf complete iod() resulting in a double completion as nvmet pci epf exec iod work() also calls nvmet pci epf complete iod() when nvmet req init() fails.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

Related Identifiers

BDU:2026-03078
CVE-2025-38658
OPENSUSE-SU-2025:20081-1
SUSE-SU-2025:21074-1
SUSE-SU-2025:21139-1
SUSE-SU-2025:21179-1

Affected Products

Astra Linux
Linux Kernel
Suse
Nvme-Cli