Linux kernel NVMe-oF TCP host (nvme-tcp R2T PDU request-list handling): Nvme_tcp_handle_r2t() did not check that the

CVSS 9.8CVE-2025-38264Firmware, BMC & network fabriccurated

Impact

Nvme_tcp_handle_r2t() did not check that the request identified by an inbound Ready-to-Transfer PDU was not already on a list, so a malicious target sends a crafted R2T and injects a loop into the initiator's request list. The commit message says it plainly - a malicious R2T PDU. Every GPU node connected to that target is affected, and the corruption is in the block-layer request path, so it sits directly under the filesystem holding checkpoints and datasets.

Who can reach it

Remote, from the target side. A hostile or compromised NVMe/TCP target, or an attacker who can inject into an unencrypted NVMe/TCP session on the storage network.

What to do

Kernel update on compute nodes validating the request state in nvme_tcp_handle_r2t(). Consider NVMe/TCP over TLS on the storage path so R2T PDUs cannot be injected by an on-path attacker, and treat the storage network as a trust boundary rather than as infrastructure.

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0bf04c874fcb1ae46a863034296e4b33d8fbd66c https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38264.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.