---
id: CVE-2025-21927
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

  nvme_tcp_recv_pdu() doesn't check the validity of the header length.
  When header digests are enabled, …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

  nvme_tcp_recv_pdu() doesn't check the validity of the header length.
  When header digests are enabled, …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
  - CWE-787
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.0, < 6.12.19'
  - 'linux_kernel >= 6.13, < 6.13.7'
  - linux_kernel = 6.14
patched:
  - linux_kernel 6.13.7
published: '2025-04-01'
updated: '2026-07-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-21927'
references:
  - url: 'https://git.kernel.org/stable/c/22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9fbc953d6b38bc824392e01850f0aeee3b348722'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ad95bab0cd28ed77c2c0d0b6e76e03e031391064'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00486
epssPercentile: 0.39283
ingestedAt: '2026-07-30T17:54:56.132Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

nvme_tcp_recv_pdu() doesn't check the validity of the header length.
When header digests are enabled, a target might send a packet with an
invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst()
to access memory outside the allocated area and cause memory corruptions
by overwriting it with the calculated digest.

Fix this by rejecting packets with an unexpected header length.

## Affected

- `linux_kernel >= 5.0, < 6.12.19`
- `linux_kernel >= 6.13, < 6.13.7`
- `linux_kernel = 6.14`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.13.7`