CVE-2025-38209

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: remove tag set when second admin queue config fails

Commit 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure

concatenation") modified nvme_tcp_setup_ctrl() to call

nvme_tcp_configure_admin_queue() twice. The first call prepares for

DH-CHAP negotitation, and the second call is required for secure

concatenation. However, this change triggered BUG KASAN slab-use-after-

free in blk_mq_queue_tag_busy_iter(). This BUG can be recreated by

repeating the blktests test case nvme/063 a few times [1].

When the BUG happens, nvme_tcp_create_ctrl() fails in the call chain

below:

nvme_tcp_create_ctrl()

nvme_tcp_alloc_ctrl() new=true ... Alloc nvme_tcp_ctrl and admin_tag_set

nvme_tcp_setup_ctrl() new=true

nvme_tcp_configure_admin_queue() new=true ... Succeed

nvme_alloc_admin_tag_set() ... Alloc the tag set for admin_tag_set

nvme_stop_keep_alive()

nvme_tcp_teardown_admin_qu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References