cbcvebase.
CVE-2025-38035
published 2025-06-18

CVE-2025-38035: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: don't restore null sk_state_change queue->state_change is set as part of…

medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: don't restore null sk_state_change queue->state_change is set as part of nvmet_tcp_set_queue_sock(), but if the TCP connection isn't established when nvmet_tcp_set_queue_sock() is called then queue->state_change isn't set and sock->sk->sk_state_change isn't replaced. As such we don't need to restore sock->sk->sk_state_change if queue->state_change is NULL. This avoids NULL pointer dereferences such as this: [ 286.462026][ C0] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 286.462814][ C0] #PF: supervisor instruction fetch in kernel mode [ 286.463796][ C0] #PF: error_code(0x0010) - not-present page [ 286.464392][ C0] PGD 8000000140620067 P4D 8000000140620067 PUD 114201067 PMD 0 [ 286.465086][ C0] Oops: Oops: 0010 [#1] SMP KASAN PTI [ 286.465559][ C0] CPU: 0 UID: 0 PID: 1628 Comm: nvme Not tainted 6.15.0-rc2+ #11 PREEMPT(voluntary) [ 286.466393][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 [ 286.467147][ C0] RIP: 0010:0x0 [ 286.467420][ C0] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 286.467977][ C0] RSP: 0018:ffff8883ae008580 EFLAGS: 00010246 [ 286.468425][ C0] RAX: 0000000000000000 RBX: ffff88813fd34100 RCX: ffffffffa386cc43 [ 286.469019][ C0] RDX: 1ffff11027fa68b6 RSI: 0000000000000008 RDI: ffff88813fd34100 [ 286.469545][ C0] RBP: ffff88813fd34160 R08: 0000000000000000 R09: ffffed1027fa682c [ 286.470072][ C0] R10: ffff88813fd34167 R11: 0000000000000000 R12: ffff88813fd344c3 [ 286.470585][ C0] R13: ffff88813fd34112 R14: ffff88813fd34aec R15: ffff888132cdd268 [ 286.471070][ C0] FS: 00007fe3c04c7d80(0000) GS:ffff88840743f000(0000) knlGS:0000000000000000 [ 286.471644][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.472543][ C0] CR2: ffffffffffffffd6 CR3: 000000012daca000 CR4: 00000000000006f0 [ 286.473500][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 286.474467][ C0]

Affected

37 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
debianlinux-6.1< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
linuxlinux
linuxlinux>= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 6265538446e2426f4bf3b57e91d7680b2047ddd96265538446e2426f4bf3b57e91d7680b2047ddd9
linuxlinux>= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 17e58be5b49f58bf17799a504f55c2d05ab2ecdc17e58be5b49f58bf17799a504f55c2d05ab2ecdc
linuxlinux>= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < fc01b547c3f8bfa6e1d23cd5a2c63c736e8c3e4efc01b547c3f8bfa6e1d23cd5a2c63c736e8c3e4e
linuxlinux>= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < c240375587ddcc80e1022f52ee32b946bbc3a639c240375587ddcc80e1022f52ee32b946bbc3a639
linuxlinux>= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 3a982ada411b8c52695f1784c3f4784771f302093a982ada411b8c52695f1784c3f4784771f30209
linuxlinux>= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < ec462449f4cf616b0aa2ed119f5f44b5fdfcefabec462449f4cf616b0aa2ed119f5f44b5fdfcefab
linuxlinux>= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < a21cb31642ffc84ca4ce55028212a96f72f54d30a21cb31642ffc84ca4ce55028212a96f72f54d30
linuxlinux>= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 46d22b47df2741996af277a2838b95f130436c1346d22b47df2741996af277a2838b95f130436c13
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.244-15.10.244-1
linuxlinux_kernel>= 0 < 6.1.147-16.1.147-1
linuxlinux_kernel>= 0 < 6.12.32-16.12.32-1
linuxlinux_kernel>= 0 < 6.12.32-16.12.32-1
linuxlinux_kernel>= 0 < 5.15.0-152.1625.15.0-152.162
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 5.0 < 5.4.2945.4.294
linuxlinux_kernel>= 5.11 < 5.15.1855.15.185
linuxlinux_kernel>= 5.16 < 6.1.1416.1.141
linuxlinux_kernel>= 5.5 < 5.10.2385.10.238
linuxlinux_kernel>= 6.13 < 6.14.96.14.9
linuxlinux_kernel>= 6.2 < 6.6.936.6.93

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM