CVE-2025-38075
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-12-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 3.1 (inc) to 5.4.294 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.238 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.185 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.141 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.93 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.31 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.14.9 (exc) |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's iSCSI target implementation where a NOPIN response timer may expire on a deleted connection, leading to a kernel crash due to a NULL pointer dereference. Specifically, the timer may be restarted improperly after expiration, causing the kernel to attempt to access invalid memory and crash. The fix involves stopping the NOPIN timer before stopping the NOPIN response timer to prevent the timer from being restarted on a deleted connection.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to a NULL pointer dereference when the NOPIN response timer expires on a deleted iSCSI connection. Such a crash can lead to system instability, downtime, and potential loss of availability for services relying on the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for specific error messages related to the iscsi target module. Look for logs indicating a NOPIN response timer expiration on a deleted connection and kernel NULL pointer dereference crashes. For example, check for messages like: 'Did not receive response to NOPIN on CID' and 'BUG: Kernel NULL pointer dereference'. You can use the command 'dmesg | grep -i iscsi' or 'journalctl -k | grep -i iscsi' to find such logs.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the nopin timer is stopped before stopping the nopin response timer to prevent the timer from being restarted on expiration. Practically, this means applying the patch or update that fixes the iscsi target module to handle timer stopping correctly. Until the fix is applied, monitor for the described kernel crashes and consider disabling or limiting iscsi target usage if feasible.