SPDK (Storage Performance Development Kit) 25.05 - NVMe-oF target, lib/nvmf: A buffer overflow in the NVMe-oF target

Impact

A buffer overflow in the NVMe-oF target component of SPDK 25.05. SPDK is the userspace, poll-mode NVMe-oF target most commonly deployed by neoclouds and storage vendors precisely because it outperforms the kernel target, so it fronts tenant namespaces in exactly the environments this database is aimed at. NVD scores it as requiring high privileges with limited integrity impact plus availability loss, so the realistic outcome is a target crash - taking every attached tenant's I/O with it - rather than a clean takeover. Worth tracking because NeVerMore separately verified seven NVMe-oF protocol attacks against SPDK, so the target's overall exposure is broader than this single defect.

Who can reach it

Reached through the NVMe-oF target path in lib/nvmf on SPDK 25.05. NVD's vector puts it at network-adjacent reachability with high privileges required, which in practice means an authenticated or otherwise privileged initiator context rather than an anonymous peer. Public detail is thin - the advisory text is a one-line description with no reproducer.

What to do

Upgrade SPDK past 25.05 and restart the target process - no kernel change, no host reboot, but the restart drops all NVMe-oF connections, so run it behind multipath initiators or during a maintenance window per storage node. Combine with the NVMe-oF hardening in the discovery-controller entry: in-band DH-HMAC-CHAP, per-subsystem host allow-lists, and discovery on a management-only interface. Since SPDK is a library embedded in vendor and in-house appliances, check with your storage vendor which SPDK release their firmware ships rather than assuming the host package version is what is running.

References

Related entries

• HashiCorp go-slug: Unicode normalization mismatch lets excluded files slip past .terraformignore into the uploadCVE-2026-14978 · HashiCorp go-slug (.terraformignore path matching, Unicode normalization)Medium
• IBM Storage Scale management GUI (deploy and upgrade logging): The Storage Scale admin password is written in the clearCVE-2026-19483 · IBM Storage Scale management GUI (deploy and upgrade logging)Medium
• Linux kernel CephFS client: invalid kfree() when listing .snap directories oopses the nodeCVE-2026-23201 · Linux kernel CephFS client (parse_longname snapshot handling)Medium
• Linux perf/x86 - event pointer setup ordering in x86_pmu_enable(): A NULL pointer dereference in the x86 PMU enableCVE-2026-23435 · Linux perf/x86 - event pointer setup ordering in x86_pmu_enable()Medium
• GitLab EE: project Maintainer can open a terminal on a protected environment they are not authorized forCVE-2026-3035 · GitLab EE (protected environment terminal authorization)Medium
• Linux EDAC/mc - error path ordering in edac_mc_alloc(): When a private-data allocation fails in edac_mc_alloc()CVE-2026-31689 · Linux EDAC/mc - error path ordering in edac_mc_alloc()Medium