CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Initialize iscsiconn->dddata only if memory is allocated
In case of an ibfastregmr allocation failure during iSER setup, the machine hits a panic because iscsiconn->dddata is initialized unconditionally, even when no memory is allocated (ddsize == 0). This leads invalid pointer dereference during connection teardown.
Fix by setting iscsiconn->dddata only if memory is actually allocated.
Panic trace: ------------ iser: isercreatefastregdesc: Failed to allocate ibfastregmr err=-12 iser: iserallocrxdescriptors: failed allocating rx descriptors / data buffers BUG: unable to handle page fault for address: fffffffffffffff8 RIP: 0010:swakeuplocked.part.5+0xa/0x40 Call Trace: complete+0x31/0x40 iscsiiserconnstop+0x88/0xb0 [ibiser] iscsistopconn+0x66/0xc0 [scsitransportiscsi] iscsiifstopconn+0x14a/0x150 [scsitransportiscsi] iscsiifrx+0x1135/0x1834 [scsitransportiscsi] ? netlinklookup+0x12f/0x1b0 ? netlinkdelivertap+0x2c/0x200 netlinkunicast+0x1ab/0x280 netlinksendmsg+0x257/0x4f0 ? copyfromuser+0x29/0x60 socksendmsg+0x5f/0x70
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Set iscsi_conn->dd_data only if memory was actually allocated; do not initialize it unconditionally when dd_size == 0.
Linux kernel scsi/libiscsi iscsi_conn->dd_data initialization = Initialize only when memory is allocated (dd_size != 0)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38700?
CVE-2025-38700 has a high severity due to the potential for causing system panic upon allocation failure.
How do I fix CVE-2025-38700?
To fix CVE-2025-38700, update the Linux kernel to the latest version where the vulnerability has been resolved.
Which versions of the Linux Kernel are affected by CVE-2025-38700?
CVE-2025-38700 affects specific versions of the Linux Kernel that include the vulnerable code related to iscsi_conn->dd_data.
What are the potential impacts of CVE-2025-38700?
The potential impacts of CVE-2025-38700 include system crashes and unresponsive behavior during iSER setup.
Who is responsible for addressing CVE-2025-38700?
The maintainers of the Linux Kernel are responsible for addressing CVE-2025-38700 through patches and updates.