CVE-2025-38700

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38700
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38700.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38700
Downstream
Related
Published
2025-09-04T15:32:52.241Z
Modified
2026-05-28T03:54:46.022411334Z
Summary
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Initialize iscsiconn->dddata only if memory is allocated

In case of an ibfastregmr allocation failure during iSER setup, the machine hits a panic because iscsiconn->dddata is initialized unconditionally, even when no memory is allocated (ddsize == 0). This leads invalid pointer dereference during connection teardown.

Fix by setting iscsiconn->dddata only if memory is actually allocated.

Panic trace:

iser: isercreatefastregdesc: Failed to allocate ibfastregmr err=-12 iser: iserallocrxdescriptors: failed allocating rx descriptors / data buffers BUG: unable to handle page fault for address: fffffffffffffff8 RIP: 0010:swakeuplocked.part.5+0xa/0x40 Call Trace: complete+0x31/0x40 iscsiiserconnstop+0x88/0xb0 [ibiser] iscsistopconn+0x66/0xc0 [scsitransportiscsi] iscsiifstopconn+0x14a/0x150 [scsitransportiscsi] iscsiifrx+0x1135/0x1834 [scsitransportiscsi] ? netlinklookup+0x12f/0x1b0 ? netlinkdelivertap+0x2c/0x200 netlinkunicast+0x1ab/0x280 netlinksendmsg+0x257/0x4f0 ? copyfromuser+0x29/0x60 sock_sendmsg+0x5f/0x70

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38700.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5d91e209fb21fb9cc765729d4c6a85a9fb6c9187
Fixed
f53af99f441ee79599d8df6113a7144d74cf9153
Fixed
9ea6d961566c7d762ed0204b06db05756fdda3b6
Fixed
fd5aad080edb501ab5c84b7623d612d0e3033403
Fixed
a145c269dc5380c063a20a0db7e6df2995962e9d
Fixed
66a373f50b4249d57f5a88c7be9676f9d5884865
Fixed
35782c32528d82aa21f84cb5ceb2abd3526a8159
Fixed
a33d42b7fc24fe03f239fbb0880dd5b4b4b97c19
Fixed
2b242ea14386a510010eabfbfc3ce81a101f3802
Fixed
3ea3a256ed81f95ab0f3281a0e234b01a9cae605

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38700.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.27
Fixed
5.4.297
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.241
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.190
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.149
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.103
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.43
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.11
Type
ECOSYSTEM
Events
Introduced
6.16.0
Fixed
6.16.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38700.json"