Memory Corruption Vulnerability in Linux Kernel nvme-tcp Component

CVE-2025-21927

Summary

A vulnerability in the nvme-tcp component of the Linux kernel allows for potential memory corruption due to improper validation of header lengths in received packets. When header digests are enabled, malicious actors could exploit this flaw by sending packets with invalid header lengths, such as 255. This can lead to the nvme_tcp_verify_hdgst function attempting to access memory outside allocated areas, potentially overwriting critical data with calculated digests. The vulnerability has been addressed by implementing checks to reject packets with unexpected header lengths, enhancing overall system security.

References