Security readout for executives and security teams
Plain-English summary
A Linux NVMe-over-TCP cleanup error can leave storage-management data pointing to freed memory when a second administrative queue setup fails. A later timeout can access that memory, producing a kernel bug and potentially disrupting affected storage hosts. The supplied record rates it critical, although the public evidence demonstrates a use-after-free rather than practical compromise.
Executive priority
Treat affected NVMe/TCP storage infrastructure as an urgent patching item because a kernel memory-safety failure could interrupt storage availability. Prioritize exposed and business-critical hosts, but do not infer confirmed remote takeover from the 9.8 score alone; the supplied evidence does not establish active exploitation or reliable attacker control.
Technical view
After the first administrative queue configuration succeeds, a second configuration attempt used for secure concatenation can fail without removing the administrative tag set. Controller cleanup then frees the containing nvme_tcp_ctrl. A later timeout handler accesses its stale admin_tag_set field, causing a KASAN-detected slab use-after-free. The fix routes failure through teardown that removes the tag set.
Likely exposure
Exposure is limited to Linux systems using the NVMe/TCP controller path containing introducing commit 104d0e2f6222, particularly where DH-CHAP and secure-concatenation queue reconfiguration occurs. The bundle lists Linux 6.15, 6.15.4, and 6.16, but packaged kernels may contain backports, so version numbers alone are insufficient.
Exploitation context
The bundle reports no CISA KEV listing and provides no evidence of active exploitation or a public weaponized exploit. The bug was reproduced by repeatedly running blktests nvme/063. Whether an unauthenticated network attacker can reliably trigger or control the freed memory is not established by these sources.
Researcher notes
The important precondition is failure of the second nvme_tcp_configure_admin_queue call with new=false after initial tag-set allocation. The missing removal leaves timeout processing with a dangling reference. Public evidence supports reproducible use-after-free and likely denial of service; confidentiality and integrity impact, trigger reachability from an untrusted network, and exploitation reliability remain unproven.
Mitigation direction
- Apply a vendor kernel update containing one of the referenced stable fixes after confirming applicability.
- Prioritize NVMe/TCP storage hosts whose kernels include introducing commit 104d0e2f6222.
- Check distribution advisories for backported fixes; package versions may not match upstream numbering.
- Follow vendor guidance if an updated kernel is not yet available.
Validation and detection
- Inventory systems using NVMe/TCP and record their exact kernel builds.
- Compare kernel source or backport history against the introducing and fixing commits.
- Confirm the updated kernel contains teardown logic that removes the administrative tag set on second-configuration failure.
- Review kernel logs for KASAN use-after-free reports, NVMe/TCP controller failures, or timeout-related crashes.
- Regression-test NVMe/TCP authentication and reconnection failure handling in a controlled environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38209 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/db1da838b6012e4570c6f81e28ffe1d0ff595948CVE reference, Linux
- https://git.kernel.org/stable/c/e7143706702a209c814ed2c3fc6486c2a7decf6cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.