CVE-2025-37825

nvmet: fix out-of-bounds access in nvmet_enable_port

published May 8, 2025

CVSS
—
EPSS
0%
Percentile
6.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix out-of-bounds access in nvmet_enable_port

When trying to enable a port that has no transport configured yet,

nvmet_enable_port() uses NVMF_TRTYPE_MAX (255) to query the transports

array, causing an out-of-bounds access:

[ 106.058694] BUG: KASAN: global-out-of-bounds in nvmet_enable_port+0x42/0x1da

[ 106.058719] Read of size 8 at addr ffffffff89dafa58 by task ln/632

[...]

[ 106.076026] nvmet: transport type 255 not supported

Since commit 200adac75888, NVMF_TRTYPE_MAX is the default state as configured by

nvmet_ports_make().

Avoid this by checking for NVMF_TRTYPE_MAX before proceeding.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00173 · 6.4th percentile
Published
2025-05-08T06:26Z
EPSS history
Timeline
  • 08 MAY 06:26Z
    nvmet: fix out-of-bounds access in nvmet_enable_port
    cvelistv5