CVE-2025-38209
A critical bug in the Linux kernel’s NVMe over TCP implementation can cause a use‑after‑free error, potentially crashing the system or allowing code execution. The flaw occurs when the second admin queue configuration fails, leaving a dangling tag set that is later accessed by a timeout handler. The issue has been fixed in a kernel patch that ensures the tag set is removed on failure.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel (NVMe over TCP) – any system running a kernel version before the patch that contains the bug. Typical users are Linux administrators and end‑users who rely on NVMe over TCP for storage networking.
Real-world impact
An attacker could trigger the bug to crash the kernel or potentially execute code with kernel privileges, leading to denial of service or privilege escalation.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact: it requires no user interaction, can be exploited remotely, and gives attackers full control over the system, leading to complete compromise.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for the NVMe over TCP use‑after‑free bug.
- 02Reboot the system to load the updated kernel.
NVD description
Timeline
- Jul 4, 2025 · Jul 4, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.