Security readout for executives and security teams
Plain-English summary
CVE-2025-38035 is a Linux kernel denial-of-service flaw in the NVMe-over-TCP target path. Under a connection timing condition, the kernel may install a null socket callback; later TCP processing can call it and crash the host. The business impact is loss of availability on affected storage targets. The supplied CVSS score is 7.5; confidentiality and integrity impacts are not claimed.
Executive priority
High for organizations operating reachable or business-critical NVMe-over-TCP targets. Patch promptly after compatibility testing, using emergency handling for exposed or availability-sensitive storage infrastructure. Priority is lower for systems confirmed not to provide this service. Current evidence supports host crashes and service disruption, not theft or modification of data.
Technical view
If nvmet_tcp_set_queue_sock() runs before the TCP connection is established, queue->state_change can remain NULL because the socket callback was not replaced. Cleanup incorrectly restores that NULL value. Later TCP state processing, including FIN handling, may invoke the null callback, causing a kernel NULL-pointer dereference and system crash. Referenced Linux stable commits prevent restoration when no saved callback exists.
Likely exposure
Likely exposure is limited to Linux systems operating the NVMe-over-TCP target component, particularly where untrusted initiators can reach its TCP service. The record identifies affected kernel lines from 5.0 through 6.15, but its flattened version data does not establish dependable package boundaries. Systems not providing NVMe-over-TCP target service are unlikely to exercise this path.
Exploitation context
The supplied vector is network-accessible, low-complexity, unauthenticated, and requires no user interaction. However, the bundle provides no exploit procedure. KEV is false, and no cited source reports active exploitation. Treat this as potentially remotely triggerable denial of service, not demonstrated code execution or data compromise.
Researcher notes
Crash evidence shows instruction execution at address zero during TCP receive and FIN processing. The correction guards callback restoration when queue->state_change is NULL. The supplied description is truncated, and its version representation is ambiguous; researchers should verify exact vulnerable and corrected boundaries against the relevant stable branch or distribution package advisory.
Mitigation direction
- Update affected NVMe-over-TCP targets to a vendor kernel containing the referenced stable fix.
- Prioritize broadly reachable NVMe-over-TCP services and high-availability storage infrastructure.
- If patching is delayed, restrict NVMe-over-TCP access to trusted initiators using existing network controls.
- Check distribution advisories for exact packages; the bundle does not provide reliable package boundaries.
Validation and detection
- Inventory Linux hosts acting as NVMe-over-TCP targets and determine whether nvmet-tcp is actively used.
- Record running kernel packages and map them to distribution advisories or the referenced stable commits.
- Confirm the corrected kernel is active after the maintenance reboot.
- Review kernel logs for NULL dereferences, RIP address zero, nvmet-tcp, or tcp_fin-related crashes.
Public sources used
- CVE Program record
- CVE List V5 record
- Linux stable fix 6265538446e2
- Linux stable fix 17e58be5b49f
- Linux stable fix fc01b547c3f8
- Linux stable fix c240375587dd
- Linux stable fix 3a982ada411b
- Linux stable fix ec462449f4cf
- Linux stable fix a21cb31642ff
- Linux stable fix 46d22b47df27
- Debian LTS advisory reference 00008
- Debian LTS advisory reference 00007
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38035 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6265538446e2426f4bf3b57e91d7680b2047ddd9CVE reference, Linux
- https://git.kernel.org/stable/c/17e58be5b49f58bf17799a504f55c2d05ab2ecdcCVE reference, Linux
- https://git.kernel.org/stable/c/fc01b547c3f8bfa6e1d23cd5a2c63c736e8c3e4eCVE reference, Linux
- https://git.kernel.org/stable/c/c240375587ddcc80e1022f52ee32b946bbc3a639CVE reference, Linux
- https://git.kernel.org/stable/c/3a982ada411b8c52695f1784c3f4784771f30209CVE reference, Linux
- https://git.kernel.org/stable/c/ec462449f4cf616b0aa2ed119f5f44b5fdfcefabCVE reference, Linux
- https://git.kernel.org/stable/c/a21cb31642ffc84ca4ce55028212a96f72f54d30CVE reference, Linux
- https://git.kernel.org/stable/c/46d22b47df2741996af277a2838b95f130436c13CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.