Security readout for executives and security teams
Plain-English summary
A Linux NVMe-over-TCP target can send a malformed header that causes memory corruption on an affected client when header digests are enabled. The result may include kernel crashes or broader system compromise, although the supplied sources do not document a demonstrated compromise or real-world exploitation.
Executive priority
Treat as an urgent infrastructure patch for organizations using NVMe/TCP with header digests. Prioritize storage clients connected across less-trusted boundaries. Systems not using NVMe/TCP, or not enabling header digests, do not match the documented trigger conditions.
Technical view
nvme_tcp_recv_pdu() failed to validate the received header length. With header digests enabled, an unexpected length can make nvme_tcp_verify_hdgst() write the calculated digest outside its allocated memory. The kernel fix rejects packets whose header length is unexpected.
Likely exposure
Exposure is limited to affected Linux systems using the NVMe/TCP initiator with header digests enabled. The supplied data flags versions 5.0, 6.12.19, 6.13.7, and 6.14, but does not clearly define complete ranges or distribution backports. Confirm status with the Linux distributor.
Exploitation context
The bundle marks KEV false, and no supplied source reports active exploitation or a public proof of concept. Triggering requires a target that sends a malformed NVMe/TCP packet while header digests are enabled.
Researcher notes
This is a CWE-787 out-of-bounds write involving digest placement after insufficient header-length validation. The supplied CVSS is 9.8, but practical reach depends on NVMe/TCP deployment and digest configuration. Version-range precision and exploitability beyond memory corruption are not established by the bundle.
Mitigation direction
- Apply a vendor-supported kernel update containing the unexpected-header-length validation fix.
- Check Linux distributor guidance for affected package versions and backported fixes.
- Prioritize systems connecting to untrusted, compromised, or externally managed NVMe/TCP targets.
- Until patched, restrict NVMe/TCP connectivity to authorized storage targets and controlled networks.
Validation and detection
- Inventory Linux hosts using NVMe/TCP initiator functionality.
- Determine whether header digests are enabled for active NVMe/TCP sessions.
- Record each host's exact kernel package, release, and distributor patch level.
- Confirm the installed kernel contains an applicable referenced fix or vendor backport.
- After updating, verify the fixed kernel is running and storage sessions remain healthy.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21927 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9fbc953d6b38bc824392e01850f0aeee3b348722CVE reference, Linux
- https://git.kernel.org/stable/c/22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126CVE reference, Linux
- https://git.kernel.org/stable/c/ad95bab0cd28ed77c2c0d0b6e76e03e031391064CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.