CVE-2025-38075

A flaw was found in the Linux kernel. The iSCSI (Internet Small Computer System Interface) target subsystem, which manages network-based storage connections, contains a vulnerability where a NOPIN response timer can improperly expire and restart on a deleted connection. This can lead to a NULL pointer dereference, a programming error that causes the system to crash. A local attacker could exploit this to cause a denial of service (DoS) on the affected system.

A MODERATE severity denial of service flaw was found in the Linux kernel's iSCSI target subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and the kernel package in Red Hat Enterprise Linux 10. When an iSCSI target connection is deleted, the NOPIN response timer can still expire and be restarted on the deleted connection, causing a NULL pointer dereference in iscsit_fill_cxn_timeout_err_stats() and a kernel panic. A local attacker with low privileges could exploit this flaw on a system configured as an iSCSI target to crash the kernel, resulting in a denial of service; confidentiality and integrity are not impacted. The fix for the affected Red Hat Enterprise Linux 8 and 9 streams is currently deferred because this is a moderate-severity, availability-only issue that requires local access and an iSCSI target configuration to exploit; the residual risk is limited to a system crash (denial of service) on systems acting as iSCSI targets. Red Hat Enterprise Linux 6 Extended Lifecycle Support and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products. The CVE.org record for this flaw assigns a CRITICAL score of 9.8 with a network attack vector, which differs from Red Hat's assessment: Red Hat rates this flaw MODERATE with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with low privileges on a system configured as an iSCSI target and impacts availability only.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable code is contained in the iscsi_target_mod kernel module. If the system does not need to provide iSCSI target functionality, this issue can be mitigated by preventing that module from loading: create the file /etc/modprobe.d/blacklist-iscsi_target_mod.conf containing the line "blacklist iscsi_target_mod" and reboot the system. Note that this prevents the system from acting as an iSCSI target, which will affect any services relying on that functionality. Systems that must provide iSCSI target functionality should apply a kernel update containing the fix when one becomes available for their release.