CVE-2025-21927

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21927", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.788Z", "datePublished": "2025-04-01T15:40:58.432Z", "dateUpdated": "2026-10-30T12:21:00.738Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:21:00.738Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()\n\nnvme_tcp_recv_pdu() doesn't check the validity of the header length.\nWhen header digests are enabled, a target might send a packet with an\ninvalid header length (e.g. 255), causing nvme_tcp_verify_hdgst()\nto access memory outside the allocated area and cause memory corruptions\nby overwriting it with the calculated digest.\n\nFix this by rejecting packets with an unexpected header length."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The malformed PDU arrives over a routable TCP connection (NVMe/TCP, typically port 4420/8009) and is parsed by the nvme-tcp host driver's socket receive path; a malicious/compromised NVMe-oF target or an on-path attacker injecting into the stream triggers it from anywhere on the network.\nAC:L - The attacker simply sets hdr->hlen to an arbitrary value (e.g. 255) with the HDGST flag in any rsp/r2t/c2h_data PDU \u2014 the out-of-bounds read and 4-byte out-of-bounds write occur deterministically, with no race, no memory-layout dependence, and unlimited retries thanks to the driver's automatic error-recovery reconnect.\nPR:N - The vulnerable parsing happens on any PDU received right after the ICReq/ICResp handshake, before the NVMe Connect command or any DH-HMAC-CHAP authentication, so the remote peer needs no credentials or privileges on the victim host whatsoever.\nUI:N - No victim action is needed at attack time \u2014 NVMe-oF connections are persistent system configuration established at boot and re-established automatically by nvme_tcp_error_recovery(), so a malicious target or on-path attacker can send the crafted PDU at will.\nS:U - The out-of-bounds access corrupts kernel slab memory within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - nvme_tcp_verify_hdgst() reads 4 raw heap bytes at an attacker-chosen offset up to 255 past a 28-byte kmalloc object and dev_err() prints them verbatim (\"recv %#x\"), giving a repeatable adjacent-heap disclosure primitive; the CRC input additionally hashes up to 227 bytes of out-of-bounds memory.\nI:H - The CRC32C result is written out of bounds at pdu + hlen, an attacker-chosen offset up to 227 bytes past a kmalloc-32 allocation, corrupting neighbouring slab objects; since 24 of the hashed bytes are attacker-controlled and CRC32C is invertible, heap grooming makes both the offset and the written 32-bit value effectively attacker-chosen \u2014 a controlled heap write suitable for control-flow hijacking.\nA:H - The out-of-bounds slab write corrupts adjacent kernel objects and slab metadata, causing oops/panic (immediate BUG under KASAN/hardened SLUB), and the attacker can repeat it across auto-reconnects to reliably crash the host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/tcp.c"], "versions": [{"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "3b54109b2f771f74fd53b027429796326f84ab36", "status": "affected", "versionType": "git"}, {"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "9d22cf5cc94cd7dee84773ec41db78a46107dfa3", "status": "affected", "versionType": "git"}, {"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "9fbc953d6b38bc824392e01850f0aeee3b348722", "status": "affected", "versionType": "git"}, {"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126", "status": "affected", "versionType": "git"}, {"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "ad95bab0cd28ed77c2c0d0b6e76e03e031391064", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/tcp.c"], "versions": [{"version": "5.0", "status": "affected"}, {"version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.19", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.7", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.13.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3b54109b2f771f74fd53b027429796326f84ab36"}, {"url": "https://git.kernel.org/stable/c/9d22cf5cc94cd7dee84773ec41db78a46107dfa3"}, {"url": "https://git.kernel.org/stable/c/9fbc953d6b38bc824392e01850f0aeee3b348722"}, {"url": "https://git.kernel.org/stable/c/22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126"}, {"url": "https://git.kernel.org/stable/c/ad95bab0cd28ed77c2c0d0b6e76e03e031391064"}], "title": "nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21927", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-01T19:22:21.408514Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:26:33.723Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21927", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-01T19:22:21.408514Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T14:37:50.335Z"}}], "cna": {"title": "nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The malformed PDU arrives over a routable TCP connection (NVMe/TCP, typically port 4420/8009) and is parsed by the nvme-tcp host driver's socket receive path; a malicious/compromised NVMe-oF target or an on-path attacker injecting into the stream triggers it from anywhere on the network.\nAC:L - The attacker simply sets hdr->hlen to an arbitrary value (e.g. 255) with the HDGST flag in any rsp/r2t/c2h_data PDU \u2014 the out-of-bounds read and 4-byte out-of-bounds write occur deterministically, with no race, no memory-layout dependence, and unlimited retries thanks to the driver's automatic error-recovery reconnect.\nPR:N - The vulnerable parsing happens on any PDU received right after the ICReq/ICResp handshake, before the NVMe Connect command or any DH-HMAC-CHAP authentication, so the remote peer needs no credentials or privileges on the victim host whatsoever.\nUI:N - No victim action is needed at attack time \u2014 NVMe-oF connections are persistent system configuration established at boot and re-established automatically by nvme_tcp_error_recovery(), so a malicious target or on-path attacker can send the crafted PDU at will.\nS:U - The out-of-bounds access corrupts kernel slab memory within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - nvme_tcp_verify_hdgst() reads 4 raw heap bytes at an attacker-chosen offset up to 255 past a 28-byte kmalloc object and dev_err() prints them verbatim (\"recv %#x\"), giving a repeatable adjacent-heap disclosure primitive; the CRC input additionally hashes up to 227 bytes of out-of-bounds memory.\nI:H - The CRC32C result is written out of bounds at pdu + hlen, an attacker-chosen offset up to 227 bytes past a kmalloc-32 allocation, corrupting neighbouring slab objects; since 24 of the hashed bytes are attacker-controlled and CRC32C is invertible, heap grooming makes both the offset and the written 32-bit value effectively attacker-chosen \u2014 a controlled heap write suitable for control-flow hijacking.\nA:H - The out-of-bounds slab write corrupts adjacent kernel objects and slab metadata, causing oops/panic (immediate BUG under KASAN/hardened SLUB), and the attacker can repeat it across auto-reconnects to reliably crash the host."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "3b54109b2f771f74fd53b027429796326f84ab36", "versionType": "git"}, {"status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "9d22cf5cc94cd7dee84773ec41db78a46107dfa3", "versionType": "git"}, {"status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "9fbc953d6b38bc824392e01850f0aeee3b348722", "versionType": "git"}, {"status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126", "versionType": "git"}, {"status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "lessThan": "ad95bab0cd28ed77c2c0d0b6e76e03e031391064", "versionType": "git"}], "programFiles": ["drivers/nvme/host/tcp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"status": "unaffected", "version": "0", "lessThan": "5.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.19", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.7", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/nvme/host/tcp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3b54109b2f771f74fd53b027429796326f84ab36"}, {"url": "https://git.kernel.org/stable/c/9d22cf5cc94cd7dee84773ec41db78a46107dfa3"}, {"url": "https://git.kernel.org/stable/c/9fbc953d6b38bc824392e01850f0aeee3b348722"}, {"url": "https://git.kernel.org/stable/c/22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126"}, {"url": "https://git.kernel.org/stable/c/ad95bab0cd28ed77c2c0d0b6e76e03e031391064"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()\n\nnvme_tcp_recv_pdu() doesn't check the validity of the header length.\nWhen header digests are enabled, a target might send a packet with an\ninvalid header length (e.g. 255), causing nvme_tcp_verify_hdgst()\nto access memory outside the allocated area and cause memory corruptions\nby overwriting it with the calculated digest.\n\nFix this by rejecting packets with an unexpected header length."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.19", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.7", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "5.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:21:00.738Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21927", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:21:00.738Z", "dateReserved": "2024-12-29T08:45:45.788Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-04-01T15:40:58.432Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3b54109b2f771f74fd53b027429796326f84ab36", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}, {"lessThan": "9d22cf5cc94cd7dee84773ec41db78a46107dfa3", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}, {"lessThan": "9fbc953d6b38bc824392e01850f0aeee3b348722", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}, {"lessThan": "22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}, {"lessThan": "ad95bab0cd28ed77c2c0d0b6e76e03e031391064", "status": "affected", "version": "3f2304f8c6d6ed97849057bd16fee99e434ca796", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.19", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F990125F-036B-4485-B832-085182829A80", "versionEndExcluding": "6.12.19", "versionStartIncluding": "5.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "842F5A44-3E71-4546-B4FD-43B0ACE3F32B", "versionEndExcluding": "6.13.7", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*", "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*", "matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*", "matchCriteriaId": "D3D6550E-6679-4560-902D-AF52DCFE905B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*", "matchCriteriaId": "45B90F6B-BEC7-4D4E-883A-9DBADE021750", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()\n\nnvme_tcp_recv_pdu() doesn't check the validity of the header length.\nWhen header digests are enabled, a target might send a packet with an\ninvalid header length (e.g. 255), causing nvme_tcp_verify_hdgst()\nto access memory outside the allocated area and cause memory corruptions\nby overwriting it with the calculated digest.\n\nFix this by rejecting packets with an unexpected header length."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-tcp: se corrige una posible corrupci\u00f3n de memoria en nvme_tcp_recv_pdu(). nvme_tcp_recv_pdu() no comprueba la validez de la longitud del encabezado. Cuando se habilitan los res\u00famenes de encabezado, un destino podr\u00eda enviar un paquete con una longitud de encabezado no v\u00e1lida (p. ej., 255), lo que provoca que nvme_tcp_verify_hdgst() acceda a memoria fuera del \u00e1rea asignada y provoque corrupciones de memoria al sobrescribirla con el resumen calculado. Para solucionar esto, rechace los paquetes con una longitud de encabezado inesperada."}], "id": "CVE-2025-21927", "lastModified": "2026-10-30T13:17:54.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21927", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T19:22:21.408514Z", "version": "2.0.3"}}]}, "published": "2025-04-01T16:15:23.470", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b54109b2f771f74fd53b027429796326f84ab36"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9d22cf5cc94cd7dee84773ec41db78a46107dfa3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9fbc953d6b38bc824392e01850f0aeee3b348722"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad95bab0cd28ed77c2c0d0b6e76e03e031391064"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:7501", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "kernel-0:6.12.0-55.11.1.el10_0", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:4341", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.40.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-04-30T00:00:00Z"}, {"advisory": "RHSA-2025:7423", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.16.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:4341", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.40.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-04-30T00:00:00Z"}, {"advisory": "RHSA-2025:4499", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-06T00:00:00Z"}, {"advisory": "RHSA-2025:7423", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.16.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:4469", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "kernel-0:5.14.0-70.131.1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-05-05T00:00:00Z"}, {"advisory": "RHSA-2025:4471", "cpe": "cpe:/a:redhat:rhel_e4s:9.0::nfv", "package": "kernel-rt-0:5.14.0-70.131.1.rt21.203.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-05-06T00:00:00Z"}, {"advisory": "RHSA-2025:4498", "cpe": "cpe:/o:redhat:rhel_e4s:9.0", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-05-06T00:00:00Z"}, {"advisory": "RHSA-2025:4339", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.115.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-04-30T00:00:00Z"}, {"advisory": "RHSA-2025:4340", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.115.1.rt14.400.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-04-30T00:00:00Z"}, {"advisory": "RHSA-2025:4496", "cpe": "cpe:/o:redhat:rhel_eus:9.2", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-05-06T00:00:00Z"}, {"advisory": "RHSA-2025:4509", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "kernel-0:5.14.0-427.67.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-05-06T00:00:00Z"}, {"advisory": "RHSA-2025:4497", "cpe": "cpe:/o:redhat:rhel_eus:9.4", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-05-06T00:00:00Z"}], "bugzilla": {"description": "kernel: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()", "id": "2356593", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2356593"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.0", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-119", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()\nnvme_tcp_recv_pdu() doesn't check the validity of the header length.\nWhen header digests are enabled, a target might send a packet with an\ninvalid header length (e.g. 255), causing nvme_tcp_verify_hdgst()\nto access memory outside the allocated area and cause memory corruptions\nby overwriting it with the calculated digest.\nFix this by rejecting packets with an unexpected header length."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent the `nvme_tcp` module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Note that this will make NVMe over TCP fabrics unavailable, and as such is not a suitable mitigation for systems relying on that technology."}, "name": "CVE-2025-21927", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21927\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21927\nhttps://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21927-36d6@gregkh/T"], "statement": "This flaw results from an improper bounds check, which an attacker could exploit by sending a packet with a too-large header. The driver processing that header will then both read beyond the bounds of the buffer it has allocated, and will also alter memory outside of the buffer when it writes the result of digest calculations. An attacker could thus read otherwise inaccessible kernel memory, causing a denial of service or exfiltrating sensitive data, or write out of bounds, which could lead to an escalation of privileges.\nWhile NVMe over fabric is typically used in the context of a single system, Red Hat's assessment suggests an Attack Vector of Adjacent. This is due to the possibility of NVMe being used as a storage solution for a cluster or datacenter.", "threat_severity": "Important"}

{}