CVE-2025-38405 nvmet: fix memory leak of bio integrity
A memory leak in the Linux kernel NVMe target driver allows attackers to cause denial of service by exhausting kernel memory through metadata commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38405?
CVE-2025-38405 is a high-severity denial of service vulnerability in Linux kernel, published on 25 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix memory leak of bio integrity
If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity.
Since commit bf4c89fc8797 ("block: don't call bio_uninit from bio_endio") each user of bio_init has to use bio_uninit as well. Otherwise the bio integrity is not getting free. Nvmet uses bio_init for inline bios.
Uninit the inline bio to complete deallocation of integrity in bio.
Weakness: CWE-401
Which versions are affected by CVE-2025-38405?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38405?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-38405 being exploited?
There is no known exploitation of CVE-2025-38405 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38405, DEBIAN-CVE-2025-38405, GHSA-5g8h-g27f-mh64, ROOT-OS-UBUNTU-2404-CVE-2025-38405, UBUNTU-CVE-2025-38405.