Linux Kernel Vulnerability in iscsi Target Handling

CVE-2025-38075

What is CVE-2025-38075?

A vulnerability in the Linux kernel's iscsi target can lead to a system crash due to a timeout issue on deleted connections. Specifically, the NOPIN response timer may expire unexpectedly, causing a NULL pointer dereference. This situation arises when the nopin timer is restarted upon expiration. To prevent this, the nopin timer must be stopped before halting the nopin response timer, ensuring that neither of them is restarted improperly. Such issues have been documented in system logs and need swift remediation to maintain stability and performance.

References