https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 05:47:59 +0000 https://db.gcve.eu/vuln/cve-2025-38658 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails</p> <p>Have nvmet_req_init() and req-&gt;execute() complete failed commands.</p> <p>Description of the problem: nvmet_req_init() calls __nvmet_req_complete() internally upon failure, e.g., unsupported opcode, which calls the &#34;queue_response&#34; callback, this results in nvmet_pci_epf_queue_response() being called, which will call nvmet_pci_epf_complete_iod() if data_len is 0 or if dma_dir is different from DMA_TO_DEVICE. This results in a double completion as nvmet_pci_epf_exec_iod_work() also calls nvmet_pci_epf_complete_iod() when nvmet_req_init() fails.</p> <p>Steps to reproduce: On the host send a command with an unsupported opcode with nvme-cli, For example the admin command &#34;security receive&#34; $ sudo nvme security-recv /dev/nvme0n1 -n1 -x4096</p> <p>This triggers a double completion as nvmet_req_init() fails and nvmet_pci_epf_queue_response() is called, here iod-&gt;dma_dir is still in the default state of &#34;DMA_NONE&#34; as set by default in nvmet_pci_epf_alloc_iod(), so nvmet_pci_epf_complete_iod() is called. Because nvmet_req_init() failed nvmet_pci_epf_complete_iod() is also called in nvmet_pci_epf_exec_iod_work() leading to a double completion. This not only sends two completions to the host but also corrupts the state of the PCI NVMe target leading to kernel oops.</p> <p>This patch lets nvmet_req_init() and req-&gt;execute() complete all failed commands, and removes the…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails</p> <p>Have nvmet_req_init() and req-&gt;execute() complete failed commands.</p> <p>Description of the problem: nvmet_req_init() calls __nvmet_req_complete() internally upon failure, e.g., unsupported opcode, which calls the &#34;queue_response&#34; callback, this results in nvmet_pci_epf_queue_response() being called, which will call nvmet_pci_epf_complete_iod() if data_len is 0 or if dma_dir is different from DMA_TO_DEVICE. This results in a double completion as nvmet_pci_epf_exec_iod_work() also calls nvmet_pci_epf_complete_iod() when nvmet_req_init() fails.</p> <p>Steps to reproduce: On the host send a command with an unsupported opcode with nvme-cli, For example the admin command &#34;security receive&#34; $ sudo nvme security-recv /dev/nvme0n1 -n1 -x4096</p> <p>This triggers a double completion as nvmet_req_init() fails and nvmet_pci_epf_queue_response() is called, here iod-&gt;dma_dir is still in the default state of &#34;DMA_NONE&#34; as set by default in nvmet_pci_epf_alloc_iod(), so nvmet_pci_epf_complete_iod() is called. Because nvmet_req_init() failed nvmet_pci_epf_complete_iod() is also called in nvmet_pci_epf_exec_iod_work() leading to a double completion. This not only sends two completions to the host but also corrupts the state of the PCI NVMe target leading to kernel oops.</p> <p>This patch lets nvmet_req_init() and req-&gt;execute() complete all failed commands, and removes the…</p> https://db.gcve.eu/vuln/cve-2025-38658