CVE-2025-21850
A flaw in the Linux kernel's NVMe target subsystem can cause the system to crash when a namespace is disabled. This happens because the system fails to ensure all pending I/O operations are finished before shutting down the namespace.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running Linux kernel version 6.14 or specific development versions like 6.13.0-rc6.
Real-world impact
An attacker or a specific sequence of system events could trigger a system crash, leading to a denial of service where the machine becomes unresponsive.
Why this severity
This is rated as critical because the vulnerability allows for a complete system crash (denial of service) and can be triggered remotely over a network without requiring special privileges or user interaction.
What to do about it
- 01Upgrade the Linux kernel to version 6.14 or later.
NVD-referenced vendor advisory
Timeline
- Mar 12, 2025 · Mar 12, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.