Riskcovery

CVE-2025-38075

scsi: target: iscsi: Fix timeout on deleted connection

State
Published
Severity
9.8 Critical
Published
Jun 18, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix timeout on deleted connection

NOPIN response timer may expire on a deleted connection and crash with such logs:

Did not receive response to NOPIN on CID: 0, failing connection for I_T Nexus (null),i,0x00023d000125,iqn.2017-01.com.iscsi.target,t,0x3d

BUG: Kernel NULL pointer dereference on read at 0x00000000 NIP strlcpy+0x8/0xb0 LR iscsit_fill_cxn_timeout_err_stats+0x5c/0xc0 [iscsi_target_mod] Call Trace: iscsit_handle_nopin_response_timeout+0xfc/0x120 [iscsi_target_mod] call_timer_fn+0x58/0x1f0 run_timer_softirq+0x740/0x860 __do_softirq+0x16c/0x420 irq_exit+0x188/0x1c0 timer_interrupt+0x184/0x410

That is because nopin response timer may be re-started on nopin timer expiration.

Stop nopin timer before stopping the nopin response timer to be sure that no one of them will be re-started.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e48354ce078c079996f89d715dfa44814b4eba01 to before 571ce6b6f5cbaf7d24af03cad592fc0e2a54de35Affected
  • e48354ce078c079996f89d715dfa44814b4eba01 to before 2c5081439c7ab8da08427befe427f0d732ebc9f9Affected
  • e48354ce078c079996f89d715dfa44814b4eba01 to before 019ca2804f3fb49a7f8e56ea6aeaa1ff32724c27Affected
  • e48354ce078c079996f89d715dfa44814b4eba01 to before 6815846e0c3a62116a7da9740e3a7c10edc5c7e9Affected
  • e48354ce078c079996f89d715dfa44814b4eba01 to before fe8421e853ef289e1324fcda004751c89dd9c18aAffected
  • e48354ce078c079996f89d715dfa44814b4eba01 to before 87389bff743c55b6b85282de91109391f43e0814Affected
  • e48354ce078c079996f89d715dfa44814b4eba01 to before 3e6429e3707943078240a2c0c0b3ee99ea9b0d9cAffected
  • e48354ce078c079996f89d715dfa44814b4eba01 to before 7f533cc5ee4c4436cee51dc58e81dfd9c3384418Affected
LinuxLinux
  • 3.1Affected
  • before 3.1Not affected
  • 5.4.294 through 5.4.*Not affected
  • 5.10.238 through 5.10.*Not affected
  • 5.15.185 through 5.15.*Not affected
  • 6.1.141 through 6.1.*Not affected
  • 6.6.93 through 6.6.*Not affected
  • 6.12.31 through 6.12.*Not affected
  • 6.14.9 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.