{"id":"CVE-2025-38399","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()\n\nThe function core_scsi3_decode_spec_i_port(), in its error code path,\nunconditionally cal…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()\n\nThe function core_scsi3_decode_spec_i_port(), in its error code path,\nunconditionally cal…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.9, < 5.10.240","linux_kernel >= 5.11, < 5.15.187","linux_kernel >= 5.16, < 6.1.144","linux_kernel >= 6.2, < 6.6.97","linux_kernel >= 6.7, < 6.12.37","linux_kernel >= 6.13, < 6.15.6","linux_kernel = 6.16","debian_linux = 11.0"],"patched":["linux_kernel 6.15.6"],"published":"2025-07-25","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:39.923","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-38399","references":[{"url":"https://git.kernel.org/stable/c/1129e0e0a833acf90429e0f13951068d5f026e4f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1627dda4d70ceb1ba62af2e401af73c09abb1eb5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55dfffc5e94730370b08de02c0cf3b7c951bbe9e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70ddb8133fdb512d4b1f2b4fd1c9e518514f182c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7296c938df2445f342be456a6ff0b3931d97f4e5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c412185d557578d3f936537ed639c4ffaaed4075","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8ab68bdb294b09a761e967dad374f2965e1913f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00502,"epssPercentile":0.42776,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-15T21:49:58.435255Z"},"ingestedAt":"2026-10-15T22:48:25.505Z","slug":"CVE-2025-38399","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()\n\nThe function core_scsi3_decode_spec_i_port(), in its error code path,\nunconditionally calls core_scsi3_lunacl_undepend_item() passing the\ndest_se_deve pointer, which may be NULL.\n\nThis can lead to a NULL pointer dereference if dest_se_deve remains\nunset.\n\nSPC-3 PR SPEC_I_PT: Unable to locate dest_tpg\nUnable to handle kernel paging request at virtual address dfff800000000012\nCall trace:\n  core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)\n  core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]\n  core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]\n  target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]\n\nFix this by adding a NULL check before calling\ncore_scsi3_lunacl_undepend_item()\n\n## Affected\n\n- `linux_kernel >= 5.9, < 5.10.240`\n- `linux_kernel >= 5.11, < 5.15.187`\n- `linux_kernel >= 5.16, < 6.1.144`\n- `linux_kernel >= 6.2, < 6.6.97`\n- `linux_kernel >= 6.7, < 6.12.37`\n- `linux_kernel >= 6.13, < 6.15.6`\n- `linux_kernel = 6.16`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.15.6`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}