CVE-2025-38075: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38075 is a vulnerability discovered in the Linux kernel's iSCSI target subsystem. The vulnerability was disclosed on June 18, 2025, and affects the SCSI target iSCSI connection handling mechanism (NVD, Wiz).

The vulnerability occurs in the NOPIN response timer handling within the iSCSI target module. When a NOPIN response timer expires on a deleted connection, it can lead to a NULL pointer dereference, resulting in a kernel crash. The issue specifically manifests when the NOPIN response timer may be re-started on NOPIN timer expiration (NVD, Wiz).

When exploited, this vulnerability can cause a kernel crash with NULL pointer dereference on read at 0x00000000, leading to system instability and potential denial of service. The crash produces error logs indicating failure to receive response to NOPIN on CID: 0 and failing connection for I_T Nexus (NVD, Wiz).

The fix involves stopping the NOPIN timer before stopping the NOPIN response timer to ensure that neither timer will be re-started. This prevents the race condition that could lead to the NULL pointer dereference. The vulnerability has been fixed in Linux kernel version 6.12.32-1 (Debian Tracker, Wiz).