In the Linux kernel, the following vulnerability has been resolved:
scsi: target: Fix NULL pointer dereference in corescsi3decodespeci_port()
The function corescsi3decodespeciport(), in its error code path, unconditionally calls corescsi3lunaclundependitem() passing the destse_deve pointer, which may be NULL.
This can lead to a NULL pointer dereference if destsedeve remains unset.
SPC-3 PR SPECIPT: Unable to locate desttpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: corescsi3lunaclundependitem+0x2c/0xf0 [targetcoremod] (P) corescsi3decodespeciport+0x120c/0x1c30 [targetcoremod] corescsi3emulateproregister+0x6b8/0xcd8 [targetcoremod] targetscsi3emulateprout+0x56c/0x840 [targetcoremod]
Fix this by adding a NULL check before calling corescsi3lunaclundependitem()
[
{
"id": "CVE-2025-38399-1eef3d63",
"digest": {
"length": 6968.0,
"function_hash": "179919656682569028307843423583065717146"
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c",
"function": "core_scsi3_decode_spec_i_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1627dda4d70ceb1ba62af2e401af73c09abb1eb5",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-235dca79",
"digest": {
"length": 7034.0,
"function_hash": "92809692992187359482189111303967464607"
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c",
"function": "core_scsi3_decode_spec_i_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70ddb8133fdb512d4b1f2b4fd1c9e518514f182c",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-2c3856c9",
"digest": {
"line_hashes": [
"18965397333529645031397679042837769065",
"191497658962933294590095644567156454494",
"124309464607245692450073098145679364832",
"161435735511713780462504314116435308199"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55dfffc5e94730370b08de02c0cf3b7c951bbe9e",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-2c4e381d",
"digest": {
"line_hashes": [
"18965397333529645031397679042837769065",
"191497658962933294590095644567156454494",
"124309464607245692450073098145679364832",
"161435735511713780462504314116435308199"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7296c938df2445f342be456a6ff0b3931d97f4e5",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-370076b7",
"digest": {
"line_hashes": [
"18965397333529645031397679042837769065",
"191497658962933294590095644567156454494",
"124309464607245692450073098145679364832",
"161435735511713780462504314116435308199"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8ab68bdb294b09a761e967dad374f2965e1913f",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-398b3fae",
"digest": {
"line_hashes": [
"18965397333529645031397679042837769065",
"191497658962933294590095644567156454494",
"124309464607245692450073098145679364832",
"161435735511713780462504314116435308199"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c412185d557578d3f936537ed639c4ffaaed4075",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-516ced91",
"digest": {
"line_hashes": [
"18965397333529645031397679042837769065",
"191497658962933294590095644567156454494",
"124309464607245692450073098145679364832",
"161435735511713780462504314116435308199"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1129e0e0a833acf90429e0f13951068d5f026e4f",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-53fc713a",
"digest": {
"length": 6979.0,
"function_hash": "58344922671351069701196899623719752499"
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c",
"function": "core_scsi3_decode_spec_i_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7296c938df2445f342be456a6ff0b3931d97f4e5",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-771941c6",
"digest": {
"line_hashes": [
"18965397333529645031397679042837769065",
"191497658962933294590095644567156454494",
"124309464607245692450073098145679364832",
"161435735511713780462504314116435308199"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70ddb8133fdb512d4b1f2b4fd1c9e518514f182c",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-7a347d15",
"digest": {
"length": 6979.0,
"function_hash": "58344922671351069701196899623719752499"
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c",
"function": "core_scsi3_decode_spec_i_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55dfffc5e94730370b08de02c0cf3b7c951bbe9e",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-9a2e3e13",
"digest": {
"length": 6979.0,
"function_hash": "58344922671351069701196899623719752499"
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c",
"function": "core_scsi3_decode_spec_i_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8ab68bdb294b09a761e967dad374f2965e1913f",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-a2ce0cc1",
"digest": {
"length": 7018.0,
"function_hash": "116362033350169245938838014867703973955"
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c",
"function": "core_scsi3_decode_spec_i_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1129e0e0a833acf90429e0f13951068d5f026e4f",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-b030458e",
"digest": {
"line_hashes": [
"18965397333529645031397679042837769065",
"191497658962933294590095644567156454494",
"124309464607245692450073098145679364832",
"161435735511713780462504314116435308199"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1627dda4d70ceb1ba62af2e401af73c09abb1eb5",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38399-f8599f40",
"digest": {
"length": 6979.0,
"function_hash": "58344922671351069701196899623719752499"
},
"deprecated": false,
"target": {
"file": "drivers/target/target_core_pr.c",
"function": "core_scsi3_decode_spec_i_port"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c412185d557578d3f936537ed639c4ffaaed4075",
"signature_type": "Function",
"signature_version": "v1"
}
]