CVE-2025-38075

What it actually does

Race condition in Linux kernel iSCSI target module allows NOPIN response timer to expire after connection deletion, triggering NULL pointer dereference in iscsit_fill_cxn_timeout_err_stats called from iscsit_handle_nopin_response_timeout.

Why it matters to the business

Kernel panic and system crash on Linux hosts running iSCSI targets disrupts storage services and may require manual reboot, affecting availability of dependent applications.

How an attack unfolds

An attacker managing iSCSI sessions deletes a connection while NOPIN timers remain active; on timer expiration the handler restarts the timer and dereferences a freed or null structure, crashing the kernel.

How to fix it

Apply kernel patches containing commit 571ce6b6f5cbaf7d24af03cad592fc0e2a54de35; for Mageia systems update chromium-browser-stable to 48.0.2564.97-1.mga5 or later patched kernel packages.

How to confirm the fix worked

Confirm presence of the fix commit in the running kernel source or binary; reproduce iSCSI NOPIN timeout scenarios without observing the strlcpy NULL dereference crash.

Typical attack path

1. Establish iSCSI session to target
2. Delete or close the connection
3. Allow NOPIN response timer to fire on the deleted connection
4. Trigger kernel NULL pointer dereference and panic

How to detect it

Search kernel logs and dmesg for strings indicating NOPIN response timeout on deleted connections followed by NULL pointer dereference in iscsit module functions.

• Did not receive response to NOPIN on CID
• iscsit_handle_nopin_response_timeout
• iscsit_fill_cxn_timeout_err_stats
• BUG: Kernel NULL pointer dereference

What your security team should do

• Prioritize kernel updates on all systems exposing iSCSI targets
• Disable iSCSI target functionality where not required
• Monitor kernel logs for NOPIN timeout messages and iSCSI module crashes
• Test patched kernels in staging before broad deployment