Skip to main content

Linux Kernel CVE-2025-38405

MEDIUM
Memory Leak (CWE-401)
2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

nvmet receives commands over the network from NVMe initiators, so AV:N better reflects the attack surface; PR:L requires an authorized initiator connection; impact is availability-only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
3.3 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:54 vuln.today
CVE Published
Jul 25, 2025 - 14:15 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix memory leak of bio integrity

If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity.

Since commit bf4c89fc8797 ("block: don't call bio_uninit from bio_endio") each user of bio_init has to use bio_uninit as well. Otherwise the bio integrity is not getting free. Nvmet uses bio_init for inline bios.

Uninit the inline bio to complete deallocation of integrity in bio.

AnalysisAI

Continuous kernel memory exhaustion in the Linux nvmet (NVMe-over-Fabrics target) subsystem leaks kmalloc-128 slab entries via bio->bi_integrity on every NVMe command with metadata, eventually degrading or denying service on affected target systems. Systems running Linux kernel through 6.16-rc4 as NVMe-oF targets and processing metadata-bearing I/O commands are affected. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating low near-term exploitation probability; this is a correctness regression from a kernel block-layer change rather than a security-targeted attack surface.

Technical ContextAI

The Linux kernel nvmet subsystem implements NVMe-over-Fabrics target functionality (cpe:2.3:o:linux:linux_kernel). For high-throughput inline I/O paths, nvmet uses bio_init to initialize stack-allocated bio structures rather than heap-allocating them. Since upstream commit bf4c89fc8797 ('block: don't call bio_uninit from bio_endio'), the block layer removed the automatic bio_uninit call from bio_endio, shifting cleanup responsibility to each bio_init caller. The nvmet inline bio path never adopted the matching bio_uninit call, leaving bio->bi_integrity (allocated from the kmalloc-128 slab via the T10-DIF/protection information path) unreleased on every I/O completion. CWE-401 (Missing Release of Memory after Effective Lifetime) precisely describes the root cause: a heap allocation whose lifetime exceeds the code path that should free it.

RemediationAI

Apply one of the three upstream stable-tree patch commits: https://git.kernel.org/stable/c/190f4c2c863af7cc5bb354b70e0805f06419c038, https://git.kernel.org/stable/c/2e2028fcf924d1c6df017033c8d6e28b735a0508, or https://git.kernel.org/stable/c/431e58d56fcb5ff1f9eb630724a922e0d2a941df. The fix adds bio_uninit for inline bios in nvmet, restoring correct memory lifecycle management. An exact patched stable release version is not independently confirmed at time of analysis - monitor linux-stable mailing list and distribution security advisories (Red Hat, Ubuntu, SUSE) for backport release versions. As a compensating control, administrators can disable protection information (T10-DIF metadata) on nvmet namespaces if end-to-end data integrity checking is not required for the workload; this eliminates the leak code path at the cost of losing hardware-assisted data integrity verification.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

Share

CVE-2025-38405 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy