Bug 2365011 (CVE-2025-37825) - CVE-2025-37825 kernel: nvmet: fix out-of-bounds access in nvmet_enable_port
Summary: CVE-2025-37825 kernel: nvmet: fix out-of-bounds access in nvmet_enable_port
Keywords:
Status: NEW
Alias: CVE-2025-37825
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-08 07:01 UTC by OSIDB Bzimport
Modified: 2025-05-08 12:19 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-05-08 07:01:22 UTC
In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix out-of-bounds access in nvmet_enable_port

When trying to enable a port that has no transport configured yet,
nvmet_enable_port() uses NVMF_TRTYPE_MAX (255) to query the transports
array, causing an out-of-bounds access:

[  106.058694] BUG: KASAN: global-out-of-bounds in nvmet_enable_port+0x42/0x1da
[  106.058719] Read of size 8 at addr ffffffff89dafa58 by task ln/632
[...]
[  106.076026] nvmet: transport type 255 not supported

Since commit 200adac75888, NVMF_TRTYPE_MAX is the default state as configured by
nvmet_ports_make().
Avoid this by checking for NVMF_TRTYPE_MAX before proceeding.

Comment 1 Avinash Hanwate 2025-05-08 12:12:45 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025050822-CVE-2025-37825-547b@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.