CVE-2025-38209 Information

Jul 05, 2025 cve

Description

In the Linux kernel the following vulnerability has been resolved:

nvme-tcp: remove tag set when second admin queue config fails

Commit 104d0e2f6222 ( vme-fabrics: reset admin connection for secure concatenation) modified nvme_tcp_setup_ctrl() to call nvme_tcp_configure_admin_queue() twice. The first call prepares for DH-CHAP negotitation and the second call is required for secure concatenation. However this change triggered BUG KASAN slab-use-after- free in blk_mq_queue_tag_busy_iter(). This BUG can be recreated by repeating the blktests test case nvme/063 a few times [1].

When the BUG happens nvme_tcp_create_ctrl() fails in the call chain below:

nvme_tcp_create_ctrl() nvme_tcp_alloc_ctrl() new=true … Alloc nvme_tcp_ctrl and admin_tag_set nvme_tcp_setup_ctrl() new=true nvme_tcp_configure_admin_queue() new=true … Succeed nvme_alloc_admin_tag_set() … Alloc the tag set for admin_tag_set nvme_stop_keep_alive() nvme_tcp_teardown_admin_queue() remove=false nvme_tcp_configure_admin_queue() new=false nvme_tcp_alloc_admin_queue() … Fail but do not call nvme_remove_admin_tag_set() nvme_uninit_ctrl() nvme_put_ctrl() … Free up the nvme_tcp_ctrl and admin_tag_set

The first call of nvme_tcp_configure_admin_queue() succeeds with new=true argument. The second call fails with new=false argument. This second call does not call nvme_remove_admin_tag_set() on failure due to the new=false argument. Then the admin tag set is not removed. However nvme_tcp_create_ctrl() assumes that nvme_tcp_setup_ctrl() would call nvme_remove_admin_tag_set(). Then it frees up struct nvme_tcp_ctrl which has admin_tag_set field. Later on the timeout handler accesses the admin_tag_set field and causes the BUG KASAN slab-use-after-free.

To not leave the admin tag set call nvme_remove_admin_tag_set() when the second nvme_tcp_configure_admin_queue() call fails. Do not return from nvme_tcp_setup_ctrl() on failure. Instead jump to \destroy_admin\ngo-to label to call nvme_tcp_teardown_admin_queue() which calls nvme_remove_admin_tag_set().

Reference

https://git.kernel.org/stable/c/db1da838b6012e4570c6f81e28ffe1d0ff595948 https://git.kernel.org/stable/c/e7143706702a209c814ed2c3fc6486c2a7decf6c

CNNVD-202507-475 (Published: 2025-07-04)

Share on: