Double Completion Vulnerability in Linux Kernel NVMe PCI EPF

CVE-2025-38658

What is CVE-2025-38658?

A vulnerability exists in the Linux Kernel's NVMe PCI EPF subsystem that can lead to double completion of commands when nvmet_req_init() fails. This occurs when an unsupported opcode is sent, triggering the nvmet_req_init() function to internally call __nvmet_req_complete() upon failure. As a result, both nvmet_pci_epf_queue_response() and nvmet_pci_epf_exec_iod_work() execute the completion callback, leading to two completions being sent to the host and potentially corrupting the state of the PCI NVMe target, culminating in a kernel oops. The fix ensures that both nvmet_req_init() and req->execute() handle failures correctly without causing double completions.

References