Security readout for executives and security teams
Plain-English summary
A timing flaw in the Linux kernel iSCSI target can leave a response timer running after its connection is deleted. When that timer expires, the kernel may dereference invalid data and crash, disrupting storage services and potentially the host. The supplied record rates it critical, although the described failure demonstrates availability impact rather than confidentiality or integrity compromise.
Executive priority
Treat affected, network-accessible iSCSI target hosts as urgent patching candidates because a kernel crash could interrupt storage and dependent business services. Avoid assuming data theft or modification from the CVSS score alone; the supplied technical evidence specifically supports denial of service. Validate actual component use before broad emergency action.
Technical view
The iSCSI target NOP-IN response timer can be restarted when the NOP-IN timer expires. During connection deletion, the response timer may consequently execute against a removed connection, reaching iscsit_fill_cxn_timeout_err_stats and causing a NULL-pointer dereference. The kernel fix stops the NOP-IN timer before stopping its response timer, preventing either timer from being restarted during teardown.
Likely exposure
Exposure is concentrated in Linux systems operating the kernel iSCSI target functionality, especially where iSCSI services are network-reachable. Systems not using this target component are unlikely to encounter the described path. The supplied affected-version data is ambiguous, so administrators should map distribution kernels to vendor advisories or referenced stable fixes.
Exploitation context
The supplied record reports CVSS 9.8 with network access, low complexity, no privileges, and no user interaction. However, it provides no proof of active exploitation, and the KEV indicator is false. The described outcome is a kernel crash arising from connection teardown and timer behavior; reliable attacker control is not established by these sources.
Researcher notes
The failure is a teardown race involving two related timers, not a generic iSCSI parsing flaw. The trace places the NULL dereference in timeout-error statistics handling after connection deletion. Stable-kernel commits document the timer shutdown ordering change. The bundle does not establish exploit reliability, attacker-controlled memory corruption, or confidentiality and integrity consequences despite the supplied CVSS vector.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced iSCSI timer-ordering fix.
- Prioritize internet-facing or untrusted-network iSCSI target hosts.
- Restrict iSCSI access to required initiators and trusted network segments.
- If immediate updating is impossible, consider disabling unused iSCSI target functionality.
- Consult distribution guidance before treating listed version labels as definitive fix boundaries.
Validation and detection
- Inventory hosts loading or configuring the Linux iSCSI target component.
- Identify kernel package versions and compare them with distribution security advisories.
- Confirm the installed kernel incorporates the applicable referenced stable commit.
- Review kernel logs for NOP-IN timeout messages and NULL-pointer crashes.
- After updating, reboot into the corrected kernel and verify its running version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38075 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/571ce6b6f5cbaf7d24af03cad592fc0e2a54de35CVE reference, Linux
- https://git.kernel.org/stable/c/2c5081439c7ab8da08427befe427f0d732ebc9f9CVE reference, Linux
- https://git.kernel.org/stable/c/019ca2804f3fb49a7f8e56ea6aeaa1ff32724c27CVE reference, Linux
- https://git.kernel.org/stable/c/6815846e0c3a62116a7da9740e3a7c10edc5c7e9CVE reference, Linux
- https://git.kernel.org/stable/c/fe8421e853ef289e1324fcda004751c89dd9c18aCVE reference, Linux
- https://git.kernel.org/stable/c/87389bff743c55b6b85282de91109391f43e0814CVE reference, Linux
- https://git.kernel.org/stable/c/3e6429e3707943078240a2c0c0b3ee99ea9b0d9cCVE reference, Linux
- https://git.kernel.org/stable/c/7f533cc5ee4c4436cee51dc58e81dfd9c3384418CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.