Bug 2365011 (CVE-2025-37825)

Summary:	CVE-2025-37825 kernel: nvmet: fix out-of-bounds access in nvmet_enable_port
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	An out-of-bounds access vulnerability was found in the Linux kernel's nvme subsystem in the `nvmet_enable_port()` function. The vulnerability can occur when a port is enabled without a transport type configured, causing the function to use the `NVMF_TRTYPE_MAX` value (255) as an array index into the `nvmet_transports` structure. The out-of-bounds read can lead to system instability, information leakage, and a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-05-08 07:01:22 UTC

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix out-of-bounds access in nvmet_enable_port

When trying to enable a port that has no transport configured yet,
nvmet_enable_port() uses NVMF_TRTYPE_MAX (255) to query the transports
array, causing an out-of-bounds access:

[  106.058694] BUG: KASAN: global-out-of-bounds in nvmet_enable_port+0x42/0x1da
[  106.058719] Read of size 8 at addr ffffffff89dafa58 by task ln/632
[...]
[  106.076026] nvmet: transport type 255 not supported

Since commit 200adac75888, NVMF_TRTYPE_MAX is the default state as configured by
nvmet_ports_make().
Avoid this by checking for NVMF_TRTYPE_MAX before proceeding.

Comment 1 Avinash Hanwate 2025-05-08 12:12:45 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025050822-CVE-2025-37825-547b@gregkh/T