Request List Handling Vulnerability in Linux Kernel by The Linux Foundation

CVE-2025-38264

What is CVE-2025-38264?

A vulnerability exists within the Linux kernel's nvme-tcp component that improperly handles request lists. Specifically, the issue arises in the nvme_tcp_handle_r2t() function, where it fails to validate requests against any existing lists. This lack of validation opens the door for a maliciously crafted R2T Protocol Data Unit (PDU) to inject a loop in the request list processing, potentially leading to resource exhaustion or system instability. Ensuring proper request validation is crucial for maintaining the integrity and reliability of the Linux operating system.

References