---
id: CVE-2025-38264
title: 'nvme-tcp: sanitize request list handling'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-tcp: sanitize request list handling

  Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of
  any list, otherwise a malicious R2T PDU might inject …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 <
    8f27d152b2a59f443091cf9e3d815f06e32e9b96
  - >-
    Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 <
    78a4adcd3fedb0728436e8094848ebf4c6bae006
  - >-
    Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 <
    f054ea62598197714a6ca7b3b387a027308f8b13
  - >-
    Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 <
    0bf04c874fcb1ae46a863034296e4b33d8fbd66c
  - Linux 5.0
published: '2025-07-09'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:36:54.626Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38264'
references:
  - url: 'https://git.kernel.org/stable/c/8f27d152b2a59f443091cf9e3d815f06e32e9b96'
  - url: 'https://git.kernel.org/stable/c/78a4adcd3fedb0728436e8094848ebf4c6bae006'
  - url: 'https://git.kernel.org/stable/c/f054ea62598197714a6ca7b3b387a027308f8b13'
  - url: 'https://git.kernel.org/stable/c/0bf04c874fcb1ae46a863034296e4b33d8fbd66c'
tags:
  - cve.org
epss: 0.00447
epssPercentile: 0.38655
ingestedAt: '2026-10-21T12:48:53.703Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: sanitize request list handling

Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of
any list, otherwise a malicious R2T PDU might inject a loop in request
list processing.

## Affected

- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 8f27d152b2a59f443091cf9e3d815f06e32e9b96`
- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 78a4adcd3fedb0728436e8094848ebf4c6bae006`
- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < f054ea62598197714a6ca7b3b387a027308f8b13`
- `Linux >= 3f2304f8c6d6ed97849057bd16fee99e434ca796 < 0bf04c874fcb1ae46a863034296e4b33d8fbd66c`
- `Linux 5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.