CVE-2025-37825: nvmet: fix out-of-bounds access in nvmet_enable_port

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-08 · updated 2026-06-17
Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix out-of-bounds access in nvmet_enable_port When trying to enable a port that has no transport configured yet, nvmet_enable_port() uses NVMF_TRTYPE_MAX (255) to query the transports array, causing an out-of-bounds access: [ 106.058694] BUG: KASAN: global-out-of-bounds in nvmet_enable_port+0x42/0x1da [ 106.058719] Read of size 8 at addr ffffffff89dafa58 by task ln/632 [...] [ 106.076026] nvmet: transport type 255 not supported Since commit 200adac75888, NVMF_TRTYPE_MAX is the default state as configured by nvmet_ports_make(). Avoid this by checking for NVMF_TRTYPE_MAX before proceeding.

Affected products

Linux kernel: from 6.14 before 6.14.5; 6.15-rc1, 6.15-rc2, 6.15-rc3 — fixed in 6.14.5

How to fix

Upgrade to a fixed version: Linux kernel 6.14.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-37825 or the next vulnerability affects your stack