CVE-2025-38405CWE-401

CVE-2025-38405

High · published July 25, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix memory leak of bio integrity

If nvmet receives commands with metadata there is a continuous memory

leak of kmalloc-128 slab or more precisely bio->bi_integrity.

Since commit bf4c89fc8797 ("block: don't call bio_uninit from bio_endio")

each user of bio_init has to use bio_uninit as well. Otherwise the bio

integrity is not getting free. Nvmet uses bio_init for inline bios.

Uninit the inline bio to complete deallocation of integrity in bio.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00399 · 33.0th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2025-07-25T18:15Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel≥ 6.10.10, < 6.12.376.12.37
linux/linux_kernel≥ 6.13, < 6.15.66.15.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
EPSS history
Timeline
  • 25 JUL 13:12Z
    nvmet: fix memory leak of bio integrity
    cvelistv5