CVE-2025-38700

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated

In case of an ib_fast_reg_mr allocation failure during iSER setup, the

machine hits a panic because iscsi_conn->dd_data is initialized

unconditionally, even when no memory is allocated (dd_size == 0). This

leads invalid pointer dereference during connection teardown.

Fix by setting iscsi_conn->dd_data only if memory is actually allocated.

Panic trace:

------------

iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12

iser: iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers

BUG: unable to handle page fault for address: fffffffffffffff8

RIP: 0010:swake_up_locked.part.5+0xa/0x40

Call Trace:

complete+0x31/0x40

iscsi_iser_conn_stop+0x88/0xb0 [ib_iser]

iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi]

iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi]

iscsi_if_rx+0x1135/0x1834 [scsi_tra

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References