Security readout for executives and security teams
Plain-English summary
A malicious NVMe-over-TCP peer can send a crafted response that corrupts Linux kernel request-list processing by creating a loop. The supplied record rates this critical, but exposure is limited to systems using the affected NVMe/TCP functionality. The bundle does not establish real-world exploitation.
Executive priority
Treat as urgent for environments using NVMe-over-TCP, especially where storage targets or transport networks are not strongly trusted. Patch exposed storage clients promptly. Avoid labeling the entire Linux estate critically exposed until NVMe/TCP usage and vendor-specific kernel applicability are confirmed.
Technical view
The flaw is in nvme_tcp_handle_r2t(), which processes Ready To Transfer PDUs. Without confirming that a request is absent from other lists, a malicious R2T PDU can inject a loop into request-list processing. The cited kernel changes add this validation. The supplied material does not describe the complete failure mode or demonstrated confidentiality, integrity, and availability impacts.
Likely exposure
Prioritize Linux hosts that load or use NVMe-over-TCP and communicate with untrusted or compromisable NVMe/TCP targets. Ordinary Linux systems not using this feature are less likely to be exposed. The supplied affected-version data is ambiguous, so distribution-specific kernel advisories should determine applicability.
Exploitation context
The supplied CVSS 3.1 score is 9.8, reflecting remote, low-complexity, unauthenticated risk without user interaction. However, the record is not in KEV, and no cited source confirms active exploitation or a public working exploit. Practical exploitation appears to require interaction with the NVMe/TCP request path.
Researcher notes
The security boundary is R2T PDU handling in the Linux NVMe/TCP client path. The fix sanitizes list membership before processing. The bundle provides three stable-kernel commits but unclear version ranges, no CWE, no proof of exploitation, and no detailed crash, corruption, or code-execution evidence. Validate backports by code change, not version numbers alone.
Mitigation direction
- Apply a vendor-supported kernel update incorporating the cited nvme-tcp fixes.
- Check Linux distribution advisories for exact affected and corrected kernel versions.
- Restrict NVMe/TCP connections to trusted storage targets and protected networks.
- Disable unused NVMe-over-TCP functionality where operationally safe.
- Increase monitoring of NVMe/TCP hosts until patching is complete.
Validation and detection
- Inventory Linux hosts configured for or actively using NVMe-over-TCP.
- Compare each running kernel against distribution-specific security guidance.
- Confirm updated kernels incorporate an applicable cited stable-kernel fix.
- Verify hosts restarted into the corrected kernel after updating.
- Review kernel and storage logs for abnormal NVMe/TCP failures or hangs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38264 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/78a4adcd3fedb0728436e8094848ebf4c6bae006CVE reference, Linux
- https://git.kernel.org/stable/c/f054ea62598197714a6ca7b3b387a027308f8b13CVE reference, Linux
- https://git.kernel.org/stable/c/0bf04c874fcb1ae46a863034296e4b33d8fbd66cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.