Linux Kernel Vulnerability in SCSI Target Implementation

CVE-2025-38399

What is CVE-2025-38399?

A vulnerability exists in the Linux kernel's SCSI target subsystem, specifically within the function core_scsi3_decode_spec_i_port(). This issue arises during error handling when the function calls core_scsi3_lunacl_undepend_item() with a potentially NULL pointer, dest_se_deve. If this pointer is not set, it can lead to a NULL pointer dereference, ultimately causing kernel panic or destabilization of the system. Implementing a NULL check before invoking this function is essential to prevent exploitation and ensure system integrity.

References