CVE-2025-38035

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: don't restore null sk_state_change

queue->state_change is set as part of nvmet_tcp_set_queue_sock(), but if

the TCP connection isn't established when nvmet_tcp_set_queue_sock() is

called then queue->state_change isn't set and sock->sk->sk_state_change

isn't replaced.

As such we don't need to restore sock->sk->sk_state_change if

queue->state_change is NULL.

This avoids NULL pointer dereferences such as this:

[ 286.462026][ C0] BUG: kernel NULL pointer dereference, address: 0000000000000000

[ 286.462814][ C0] #PF: supervisor instruction fetch in kernel mode

[ 286.463796][ C0] #PF: error_code(0x0010) - not-present page

[ 286.464392][ C0] PGD 8000000140620067 P4D 8000000140620067 PUD 114201067 PMD 0

[ 286.465086][ C0] Oops: Oops: 0010 [#1] SMP KASAN PTI

[ 286.465559][ C0] CPU: 0 UID: 0 PID: 1628 Comm: nvme Not tainted 6.15.0-rc2+ #11 PREEMPT(voluntary)

[ 286.466393][ C0] Hardware

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References