CVE-2025-38658

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails

Have nvmet_req_init() and req->execute() complete failed commands.

Description of the problem:

nvmet_req_init() calls __nvmet_req_complete() internally upon failure,

e.g., unsupported opcode, which calls the "queue_response" callback,

this results in nvmet_pci_epf_queue_response() being called, which will

call nvmet_pci_epf_complete_iod() if data_len is 0 or if dma_dir is

different from DMA_TO_DEVICE. This results in a double completion as

nvmet_pci_epf_exec_iod_work() also calls nvmet_pci_epf_complete_iod()

when nvmet_req_init() fails.

Steps to reproduce:

On the host send a command with an unsupported opcode with nvme-cli,

For example the admin command "security receive"

$ sudo nvme security-recv /dev/nvme0n1 -n1 -x4096

This triggers a double completion as nvmet_req_init() fails and

nvmet_pci_epf_queue_response() is called, here iod->dma_dir

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References