Critical NULL Pointer Dereference in Linux Kernel - CVE-2025-38399
Summary
CVE-2025-38399: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() The function core_scsi3_decode_spec_i_port(), in its error code path, unco... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various environments, from servers to embedded systems. This vulnerability affects the SCSI target subsystem, which is crucial for handling SCSI commands and managing storage devices. The vulnerability arises from a coding error that can lead to system crashes and instability.
Vulnerability Detail
In the Linux kernel, a NULL pointer dereference vulnerability has been identified in the function core_scsi3_decode_spec_i_port(). This issue occurs when the function calls core_scsi3_lunacl_undepend_item() without checking if the dest_se_deve pointer is NULL. If this pointer is unset, it can lead to a kernel panic, causing the system to become unresponsive. The vulnerability is classified as critical due to its potential to disrupt system operations and compromise stability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate risks.
Conclusion
CVE-2025-38399 is a critical vulnerability in the Linux kernel that poses significant risks to system stability. It is essential for users to update their systems to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38399 is a vulnerability in the Linux kernel that can lead to a NULL pointer dereference, potentially causing system crashes.
If exploited, this vulnerability can lead to kernel panics, resulting in system instability and unresponsiveness.
The vulnerability affects Debian versions 11, 12, and 13. You should check your version and apply the necessary updates.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and plan to apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
