CVE-2025-21927

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The malformed PDU arrives over a routable TCP connection (NVMe/TCP, typically port 4420/8009) and is parsed by the nvme-tcp host driver's socket receive path; a malicious/compromised NVMe-oF target or an on-path attacker injecting into the stream triggers it from anywhere on the network.

AC:LAttack complexity, low

The attacker simply sets hdr->hlen to an arbitrary value (e.g. 255) with the HDGST flag in any rsp/r2t/c2h_data PDU — the out-of-bounds read and 4-byte out-of-bounds write occur deterministically, with no race, no memory-layout dependence, and unlimited retries thanks to the driver's automatic error-recovery reconnect.

PR:NPrivileges required, none

The vulnerable parsing happens on any PDU received right after the ICReq/ICResp handshake, before the NVMe Connect command or any DH-HMAC-CHAP authentication, so the remote peer needs no credentials or privileges on the victim host whatsoever.

UI:NUser interaction, none

No victim action is needed at attack time — NVMe-oF connections are persistent system configuration established at boot and re-established automatically by nvme_tcp_error_recovery(), so a malicious target or on-path attacker can send the crafted PDU at will.

S:UScope, unchanged

The out-of-bounds access corrupts kernel slab memory within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

nvme_tcp_verify_hdgst() reads 4 raw heap bytes at an attacker-chosen offset up to 255 past a 28-byte kmalloc object and dev_err() prints them verbatim ("recv %#x"), giving a repeatable adjacent-heap disclosure primitive; the CRC input additionally hashes up to 227 bytes of out-of-bounds memory.

I:HIntegrity impact, high

The CRC32C result is written out of bounds at pdu + hlen, an attacker-chosen offset up to 227 bytes past a kmalloc-32 allocation, corrupting neighbouring slab objects; since 24 of the hashed bytes are attacker-controlled and CRC32C is invertible, heap grooming makes both the offset and the written 32-bit value effectively attacker-chosen — a controlled heap write suitable for control-flow hijacking.

A:HAvailability impact, high

The out-of-bounds slab write corrupts adjacent kernel objects and slab metadata, causing oops/panic (immediate BUG under KASAN/hardened SLUB), and the attacker can repeat it across auto-reconnects to reliably crash the host.