CVE-2025-21927

An unchecked buffer bounds flaw was found in the Linux kernel's NVMe TCP Fabrics driver. An attacker with the ability to send a crafted packet to an affected NVMe host could exploit this flaw to alter kernel memory, leading to an escalation of privileges or a compromise of system integrity or stability.

This flaw results from an improper bounds check, which an attacker could exploit by sending a packet with a too-large header. The driver processing that header will then both read beyond the bounds of the buffer it has allocated, and will also alter memory outside of the buffer when it writes the result of digest calculations. An attacker could thus read otherwise inaccessible kernel memory, causing a denial of service or exfiltrating sensitive data, or write out of bounds, which could lead to an escalation of privileges. While NVMe over fabric is typically used in the context of a single system, Red Hat's assessment suggests an Attack Vector of Adjacent. This is due to the possibility of NVMe being used as a storage solution for a cluster or datacenter. The NVMe/TCP driver in RHEL 8 was released as a Technology Preview feature and was never considered stable or fully supported. Therefore, RHEL 8 is out of support scope for this CVE.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nvme_tcp module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Note that this will make NVMe over TCP fabrics unavailable, and as such is not a suitable mitigation for systems relying on that technology.