High · published October 7, 2025
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: don't access released socket during error recovery
While the error recovery work is temporarily failing reconnect attempts,
running the 'nvme list' command causes a kernel NULL pointer dereference
by calling getsockname() with a released socket.
During error recovery work, the nvme tcp socket is released and a new one
created, so it is not safe to access the socket without proper check.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 6.1, < 6.1.18 | 6.1.18 |
| linux/linux_kernel | ≥ 6.2, < 6.2.5 | 6.2.5 |