CVE-2025-37825

An out-of-bounds access vulnerability was found in the Linux kernel's nvme subsystem in the nvmet_enable_port() function. The vulnerability can occur when a port is enabled without a transport type configured, causing the function to use the NVMF_TRTYPE_MAX value (255) as an array index into the nvmet_transports structure. The out-of-bounds read can lead to system instability, information leakage, and a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.