Memory Leak Vulnerability in Linux Kernel Affecting nvmet

CVE-2025-38405

What is CVE-2025-38405?

A memory leak vulnerability has been identified in the nvmet component of the Linux kernel, which occurs when commands containing metadata are processed. This issue arises from the improper handling of bio integrity, resulting in a continuous memory allocation without proper deallocation. Specifically, the lax usage of bio_init in nvmet leads to bio integrity not being freed, causing a significant memory leak. To mitigate this, the inline bios should be properly uninitialized to ensure thorough memory cleanup and prevent resource exhaustion.

References