9.8

CVE-2025-21927: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

Modified
AliasesRHSA-2025:4339RHSA-2025:4340RHSA-2025:4469
Published 01-04-2025Last modified 30-10-2026

Vulnerability summary

CVE-2025-21927 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49.8% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.62%
0%100%
Low · +0.13 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 32 · Related 29
RHSA-2025:4341RHSA-2025:4509RHSA-2025:7423SUSE-SU-2025:01600-1SUSE-SU-2025:01614-1SUSE-SU-2025:01707-1

Timeline

  1. 01-04-2025
    PublishedVulnerability first disclosed.
  2. 30-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst() to access memory outside the allocated area and cause memory corruptions by overwriting it with the calculated digest. Fix this by rejecting packets with an unexpected header length.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.62%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

Increase +0.13 pp

From 0.50% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu134 products
  • linuxAll versions (No fix recorded) | < 6.8.0-84.84
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1039.41
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Redhat63 products
  • bpftool< 0:7.0.0-284.115.1.el9_2 | < 0:5.14.0-70.131.1.el9_0
  • bpftool-debuginfo< 0:7.0.0-284.115.1.el9_2 | < 0:5.14.0-70.131.1.el9_0
  • kernel< 0:5.14.0-284.115.1.el9_2 | < 0:5.14.0-70.131.1.el9_0 | < 0:6.12.0-55.11.1.el10_0
  • kernel-64k< 0:5.14.0-284.115.1.el9_2 | < 0:6.12.0-55.11.1.el10_0
  • kernel-64k-core< 0:5.14.0-284.115.1.el9_2 | < 0:6.12.0-55.11.1.el10_0
Linux2 products
  • linux≥ 3f2304f8c6d6ed97849057bd16fee99e434ca796, < 3b54109b2f771f74fd53b027429796326f84ab36 | ≥ 3f2304f8c6d6ed97849057bd16fee99e434ca796, < 9d22cf5cc94cd7dee84773ec41db78a46107dfa3 | ≥ 3f2304f8c6d6ed97849057bd16fee99e434ca796, < 9fbc953d6b38bc824392e01850f0aeee3b348722 | ≥ 3f2304f8c6d6ed97849057bd16fee99e434ca796, < 22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126 | ≥ 3f2304f8c6d6ed97849057bd16fee99e434ca796, < ad95bab0cd28ed77c2c0d0b6e76e03e031391064 | 5.0
  • linux_kernel≥ 5.0, < 6.12.19 | ≥ 6.13, < 6.13.7 | 6.14:rc1 | 6.14:rc2 | 6.14:rc3 | 6.14:rc4 | 6.14:rc5
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.19-1

4 vendors · 200 products · Showing 200 of 273

References

50 links
Show all 50 references