CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: Fix NULL pointer dereference in corescsi3decodespeciport()
The function corescsi3decodespeciport(), in its error code path, unconditionally calls corescsi3lunaclundependitem() passing the destsedeve pointer, which may be NULL.
This can lead to a NULL pointer dereference if destsedeve remains unset.
SPC-3 PR SPECIPT: Unable to locate desttpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: corescsi3lunaclundependitem+0x2c/0xf0 [targetcoremod] (P) corescsi3decodespeciport+0x120c/0x1c30 [targetcoremod] corescsi3emulateproregister+0x6b8/0xcd8 [targetcoremod] targetscsi3emulateprout+0x56c/0x840 [targetcoremod]
Fix this by adding a NULL check before calling corescsi3lunaclundependitem()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38399?
CVE-2025-38399 is classified as a vulnerability that leads to a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2025-38399?
To fix CVE-2025-38399, update your Linux kernel to the latest version that includes the patch addressing this vulnerability.
What systems are affected by CVE-2025-38399?
CVE-2025-38399 affects all systems running vulnerable versions of the Linux kernel.
What could happen if CVE-2025-38399 is exploited?
If exploited, CVE-2025-38399 could cause a system crash due to a NULL pointer dereference.
Who is responsible for resolving CVE-2025-38399?
The Linux kernel development team is responsible for creating and distributing the patches for CVE-2025-38399.