Linux kernel nvme-tcp (admin tag set leak on secure-concatenation setup failure): After the change that reconnects the

Impact

After the change that reconnects the admin queue for NVMe-TCP secure concatenation, nvme_tcp_setup_ctrl() configures the admin queue twice. When the second attempt fails it skips nvme_remove_admin_tag_set(), yet the caller goes on to free the nvme_tcp_ctrl structure that embeds that tag set. The block-layer timeout handler then walks freed memory - a KASAN slab-use-after-free in blk_mq_queue_tag_busy_iter(), reproducible by repeating blktests nvme/063. For operators who front GPU nodes with NVMe over TCP, this sits in the connection-setup path: a storage target that is reachable but fails DH-CHAP or TLS negotiation drives the host into a use-after-free, and repeated reconnect attempts to a flapping or hostile target turn that into a repeatable host-kernel corruption. Nodes that do not use NVMe-TCP with authentication or secure concatenation never enter the affected path.

Who can reach it

Local privilege is needed to initiate an NVMe-TCP connection, but the failure that triggers the bug is decided by the remote target: anything that makes the second admin queue allocation fail (an unreachable, misbehaving, or authentication-rejecting target on the storage network) is enough. Exposure therefore depends on who can stand up or impersonate an NVMe-TCP target on the storage VLAN.

What to do

Update to a stable kernel that jumps to the destroy_admin path on the second failure (two backports linked). Drain and reboot each node that mounts NVMe-TCP namespaces. Until then, limit which targets hosts will connect to and avoid automated reconnect loops against targets failing authentication; there is no runtime toggle that removes the bug itself.

References

Related entries

• Linux kernel megaraid_sas: invalid NUMA node index causes an out-of-bounds access during driver probeCVE-2025-38239 · Linux kernel megaraid_sas driver (MSI-X vector allocation node index)High
• Linux kernel (posix-cpu-timers): TOCTOU race between handle_posix_cpu_timers() and posix_cpu_timer_del()CVE-2025-38352 · Linux kernel (posix-cpu-timers)High
• Linux kernel virtio-net: unchecked received length in xdp_linearize_page allows an out-of-bounds readCVE-2025-38375 · Linux kernel virtio-net (xdp_linearize_page received-length check)High
• Linux i915 GPU kernel driver (GT timeline / VMA allocation): A timeline is left held when VMA allocation fails, soCVE-2025-38389 · Linux i915 GPU kernel driver (GT timeline / VMA allocation)High
• Linux kernel SMC (struct smc_sock type confusion with inet_sock): Struct smc_sock does not embed struct inet_sock asCVE-2025-38475 · Linux kernel SMC (struct smc_sock type confusion with inet_sock)High
• Linux kernel (net/xfrm): The guard that forbids changing a collect_md xfrm interface never fired, so a changelink putsCVE-2025-38500 · Linux kernel (net/xfrm)High