CVE-2025-37825 — nvmet: fix out-of-bounds access in nvmet_enable_port

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix out-of-bounds access in nvmet_enable_port

When trying to enable a port that has no transport configured yet,
nvmet_enable_port() uses NVMF_TRTYPE_MAX (255) to query the transports
array, causing an out-of-bounds access:

[ 106.058694] BUG: KASAN: global-out-of-bounds in nvmet_enable_port+0x42/0x1da
[ 106.058719] Read of size 8 at addr ffffffff89dafa58 by task ln/632
[...]
[ 106.076026] nvmet: transport type 255 not supported

Since commit 200adac75888, NVMF_TRTYPE_MAX is the default state as configured by
nvmet_ports_make().
Avoid this by checking for NVMF_TRTYPE_MAX before proceeding.

Affected products

Vendor	Product	Affected	Fixed
Linux	Linux	6.14	6.14.5

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 25.10	linux-azure-fde	No fix yet	—
Ubuntu 25.04	linux	6.14.0-22.22	USN-7594-1
Ubuntu 25.04	linux-aws +3	6.14.0-1007.7	USN-7594-3, USN-7594-2, USN-7594-1
Ubuntu 25.04	linux-gcp	6.14.0-1008.8	USN-7594-1
Ubuntu 25.04	linux-realtime	6.14.0-1004.4	USN-7594-1
Ubuntu 24.04 LTS	linux-gcp-6.14	6.14.0-1011.11~24.04.1	—
Ubuntu 24.04 LTS	linux-realtime +1	No fix yet	—
Ubuntu 22.04 LTS	linux-riscv +32	No fix yet	—
Ubuntu 20.04 LTS	linux-gke +28	No fix yet	—

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	linux-gcp +14	No fix yet	—
Ubuntu 16.04 LTS	linux-hwe-edge	No fix yet	—
Ubuntu Pro Realtime 24.04 LTS	linux-realtime-6.14	6.14.0-1010.10~24.04.1	—

Red Hat