---
id: CVE-2025-38075
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: target: iscsi: Fix timeout on deleted connection

  NOPIN response timer may expire on a deleted connection and crash with
  such logs:

  Did not receive response to N…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: target: iscsi: Fix timeout on deleted connection

  NOPIN response timer may expire on a deleted connection and crash with
  such logs:

  Did not receive response to N…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.1, < 5.4.294'
  - 'linux_kernel >= 5.5, < 5.10.238'
  - 'linux_kernel >= 5.11, < 5.15.185'
  - 'linux_kernel >= 5.16, < 6.1.141'
  - 'linux_kernel >= 6.2, < 6.6.93'
  - 'linux_kernel >= 6.7, < 6.12.31'
  - 'linux_kernel >= 6.13, < 6.14.9'
  - linux_kernel = 6.15
  - debian_linux = 11.0
patched:
  - linux_kernel 6.14.9
published: '2025-06-18'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:25.470'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38075'
references:
  - url: 'https://git.kernel.org/stable/c/019ca2804f3fb49a7f8e56ea6aeaa1ff32724c27'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2c5081439c7ab8da08427befe427f0d732ebc9f9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3e6429e3707943078240a2c0c0b3ee99ea9b0d9c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/571ce6b6f5cbaf7d24af03cad592fc0e2a54de35'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6815846e0c3a62116a7da9740e3a7c10edc5c7e9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7f533cc5ee4c4436cee51dc58e81dfd9c3384418'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/87389bff743c55b6b85282de91109391f43e0814'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fe8421e853ef289e1324fcda004751c89dd9c18a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38075.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-38075'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2373376'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-38075'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38075'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025061840-CVE-2025-38075-19d6@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2025:20518'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00461
epssPercentile: 0.39803
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-15T21:47:04.426452Z'
scores:
  nvd: 9.8
  vendor: 5.5
  cna: 9.8
ingestedAt: '2026-10-15T22:48:25.491Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix timeout on deleted connection

NOPIN response timer may expire on a deleted connection and crash with
such logs:

Did not receive response to NOPIN on CID: 0, failing connection for I_T Nexus (null),i,0x00023d000125,iqn.2017-01.com.iscsi.target,t,0x3d

BUG: Kernel NULL pointer dereference on read at 0x00000000
NIP  strlcpy+0x8/0xb0
LR iscsit_fill_cxn_timeout_err_stats+0x5c/0xc0 [iscsi_target_mod]
Call Trace:
 iscsit_handle_nopin_response_timeout+0xfc/0x120 [iscsi_target_mod]
 call_timer_fn+0x58/0x1f0
 run_timer_softirq+0x740/0x860
 __do_softirq+0x16c/0x420
 irq_exit+0x188/0x1c0
 timer_interrupt+0x184/0x410

That is because nopin response timer may be re-started on nopin timer
expiration.

Stop nopin timer before stopping the nopin response timer to be sure
that no one of them will be re-started.

## Affected

- `linux_kernel >= 3.1, < 5.4.294`
- `linux_kernel >= 5.5, < 5.10.238`
- `linux_kernel >= 5.11, < 5.15.185`
- `linux_kernel >= 5.16, < 6.1.141`
- `linux_kernel >= 6.2, < 6.6.93`
- `linux_kernel >= 6.7, < 6.12.31`
- `linux_kernel >= 6.13, < 6.14.9`
- `linux_kernel = 6.15`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.14.9`

## Vendor advisories

- **RHSA-2025:20518** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2025-11-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:20518)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38075.json)