nvmet-tcp: don't restore null sk_state_change
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: don't restore null sk_state_change queue->state_change is set as part of nvmet_tcp_set_queue_sock(), but if the TCP connection isn't established when nvmet_tcp_set_queue_sock() is called then queue->state_change isn't set and sock->sk->sk_state_change isn't replaced. As such we don't need to restore sock->sk->sk_state_change if queue->state_change is NULL. This avoids NULL pointer dereferences such as this: [ 286.462026][ C0] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 286.462814][ C0] #PF: supervisor instruction fetch in kernel mode [ 286.463796][ C0] #PF: error_code(0x0010) - not-present page [ 286.464392][ C0] PGD 8000000140620067 P4D 8000000140620067 PUD 114201067 PMD 0 [ 286.465086][ C0] Oops: Oops: 0010 [#1] SMP KASAN PTI [ 286.465559][ C0] CPU: 0 UID: 0 PID: 1628 Comm: nvme Not tainted 6.15.0-rc2+ #11 PREEMPT(voluntary) [ 286.466393][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 [ 286.467147][ C0] RIP: 0010:0x0 [ 286.467420][ C0] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 286.467977][ C0] RSP: 0018:ffff8883ae008580 EFLAGS: 00010246 [ 286.468425][ C0] RAX: 0000000000000000 RBX: ffff88813fd34100 RCX: ffffffffa386cc43 [ 286.469019][ C0] RDX: 1ffff11027fa68b6 RSI: 0000000000000008 RDI: ffff88813fd34100 [ 286.469545][ C0] RBP: ffff88813fd34160 R08: 0000000000000000 R09: ffffed1027fa682c [ 286.470072][ C0] R10: fff
CVE-2025-38035
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-38035
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
"lessThan": "6265538446e2426f4bf3b57e91d7680b2047ddd9",
"versionType": "git"
},
{
"status": "affected",
"version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
"lessThan": "17e58be5b49f58bf17799a504f55c2d05ab2ecdc",
"versionType": "git"
},
{
"status": "affected",
"version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
"lessThan": "fc01b547c3f8bfa6e1d23cd5a2c63c736e8c3e4e",
"versionType": "git"
},
{
"status": "affected",
"version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
"lessThan": "c240375587ddcc80e1022f52ee32b946bbc3a639",
"versionType": "git"
},
{
"status": "affected",
"version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
"lessThan": "3a982ada411b8c52695f1784c3f4784771f30209",
"versionType": "git"
},
{
"status": "affected",
"version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
"lessThan": "ec462449f4cf616b0aa2ed119f5f44b5fdfcefab",
"versionType": "git"
},
{
"status": "affected",
"version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
"lessThan": "a21cb31642ffc84ca4ce55028212a96f72f54d30",
"versionType": "git"
},
{
"status": "affected",
"version": "872d26a391da92ed8f0c0f5cb5fef428067b7f30",
"lessThan": "46d22b47df2741996af277a2838b95f130436c13",
"versionType": "git"
}
],
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.294",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.238",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.185",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.141",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.93",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.31",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.14.9",
"versionType": "semver",
"lessThanOrEqual": "6.14.*"
},
{
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-38035
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30509 · Revision 1
- Added to Heist Feed
- Publisher date