Security readout for executives and security teams
Plain-English summary
A flaw in the Linux NVMe target can continuously leak kernel memory when processing commands containing metadata. Sustained leakage could exhaust resources, destabilize the host, or interrupt storage services. The issue affects availability; the supplied CVSS assessment does not indicate data theft or modification.
Executive priority
Prioritize reachable nvmet storage hosts because repeated metadata processing may cause resource exhaustion and service interruption. Patch through the normal kernel maintenance process, accelerating systems exposed to untrusted initiators. The absence of cited active exploitation reduces incident-response urgency but does not remove availability risk.
Technical view
The nvmet inline-bio path calls bio_init but failed to call bio_uninit. Following Linux commit bf4c89fc8797, that omission leaves bio->bi_integrity allocations, including kmalloc-128 slab objects, unreleased. The cited stable changes correct the lifecycle by uninitializing the inline bio, allowing integrity metadata to be freed.
Likely exposure
Exposure is limited to Linux systems operating as NVMe targets through nvmet and receiving metadata-bearing commands. The supplied version entries are ambiguous and should not be treated as complete ranges. Confirm whether each distribution kernel includes a cited fix or backport.
Exploitation context
The bundle reports CVSS 7.5 with network reachability, low complexity, no required privileges, and high availability impact. It marks the CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. This does not prove exploitation is impossible.
Researcher notes
This is a kernel resource-lifetime defect in the nvmet inline-bio path. The retained object is bio integrity metadata, and the stated correction adds the missing bio_uninit operation. No CWE is assigned. The bundle does not provide complete affected-range semantics, reproduction evidence, crash thresholds, or exploitation telemetry.
Mitigation direction
- Apply a vendor kernel containing a cited stable fix after appropriate testing.
- Check distribution advisories and package changelogs for backported fixes.
- Until patched, restrict NVMe target access to trusted initiators through existing network controls.
- Disable nvmet on systems where NVMe target functionality is unnecessary.
Validation and detection
- Inventory kernel versions and identify hosts configured as nvmet targets.
- Verify the installed kernel contains a cited fix or documented vendor backport.
- Confirm whether untrusted initiators can reach exposed NVMe target services.
- Monitor kernel memory and slab usage for sustained growth during legitimate metadata workloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38405 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/431e58d56fcb5ff1f9eb630724a922e0d2a941dfCVE reference, Linux
- https://git.kernel.org/stable/c/2e2028fcf924d1c6df017033c8d6e28b735a0508CVE reference, Linux
- https://git.kernel.org/stable/c/190f4c2c863af7cc5bb354b70e0805f06419c038CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.