PatchaPalooza

CVE-2025-38264: nvme-tcp: sanitize request list handling

CVE-2025-38264 is a vulnerability in nvme-tcp: sanitize request list handling, rated Important by Microsoft, with a CVSS 3.1 base score of 7.1 (High). An attacker can exploit it from an adjacent network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.45% probability of exploitation activity in the next 30 days, higher than 39% of all scored vulnerabilities. Microsoft released the fix on 3 September 2025 in the July 2025 Patch Tuesday. It affects 23 products in 1 product family (Other).

Key facts

CVE ID
CVE-2025-38264
Severity
High CVSS 7.1
Microsoft severity
Important
Exploited in the wild
No
Publicly disclosed
No
EPSS
0.45% (percentile 39%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
July 2025 Patch Tuesday
Product families
Other

CVSS score and vector

Microsoft scores CVE-2025-38264 at 7.1 (temporal 7.1) using CVSS 3.1. Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

MetricValue
Attack vectorAdjacent network
Attack complexityHigh
Privileges requiredLow
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh

NVD scores it 5.5 (MEDIUM) with CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Frequently asked questions (Microsoft)

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?

One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

Affected products (23)

Other

ProductSecurity updateTypeFixed buildRestart
20613-17084
20725-17084
20823-17084
20860-17084
20925-17086
21093-17086
21248-17084
21093
21093-21692Release NotesSecurity Update
17087-17086
20788-17084
20956-17084
21094-17084
21308-17084
21332-17084
21344-17084
21443-17084
21474-17084
21580-17084
21626-17084
21684-17084Security updateSecurity Update
21892-17084Release NotesSecurity Update
21932-17084Release NotesSecurity Update

NIST NVD data

NVD status
Analyzed
NVD CVSS
5.5 (MEDIUM)
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
linux kernelfrom 5.0, before 6.12.36
linux kernelfrom 6.13, before 6.15.5

References

Revision history

VersionDateDescription
1.0Information published.
2.0Information published.
3.0Information published.
4.0Information published.
5.0Information published.
6.0Information published.
7.0Information published.
8.0Information published.
9.0Information published.
10.0Information published.
11.0Information published.
12.0Information published.
13.0Information published.
14.0Information published.
14.1Information published.
15.0Information published.
16.0Information published.
17.0Information published.
18.0Information published.
19.0Information published.
20.0Information published.
21.0Information published.
22.0Information published.
23.0Information published.
24.0Information published.

Sources