CVE-2025-38035 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2025-38035?

CVE-2025-38035 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's NVMe over TCP (nvmet-tcp) subsystem can cause kernel crashes when TCP connections aren't properly established. This affects systems using NVMe over TCP storage protocols, potentially leading to denial of service. The vulnerability is triggered during TCP connection handling when queue->state_change is NULL.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's NVMe over TCP (nvmet-tcp) subsystem can cause kernel crashes when TCP connections aren't properly established. This affects systems using NVMe over TCP storage protocols, potentially leading to denial of service. The vulnerability is triggered during TCP connection handling when queue->state_change is NULL.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions with nvmet-tcp support, specifically vulnerable versions before the fix commits

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems with NVMe over TCP (nvmet-tcp) subsystem enabled and in use. Not vulnerable if NVMe over TCP is not configured or used.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and complete denial of service, requiring physical or remote reboot.

🟠

Likely Case

System instability or crash when NVMe over TCP connections fail to establish properly, affecting storage availability.

🟢

If Mitigated

Minor performance impact or connection failures without system crash if proper error handling is in place.

🌐 Internet-Facing: MEDIUM - Requires NVMe over TCP exposure to untrusted networks, which is less common than standard TCP services.

🏢 Internal Only: LOW - Typically requires local network access and specific NVMe over TCP configuration.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires ability to establish or disrupt NVMe over TCP connections. No public exploit code available at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 17e58be5b49f58bf17799a504f55c2d05ab2ecdc, 3a982ada411b8c52695f1784c3f4784771f30209, 46d22b47df2741996af277a2838b95f130436c13, 6265538446e2426f4bf3b57e91d7680b2047ddd9, a21cb31642ffc84ca4ce55028212a96f72f54d30

Vendor Advisory: https://git.kernel.org/stable/c/17e58be5b49f58bf17799a504f55c2d05ab2ecdc

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution vendor for patched kernel packages. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable NVMe over TCP

linux

Disable the nvmet-tcp subsystem if not required

modprobe -r nvmet-tcp
echo 'blacklist nvmet-tcp' >> /etc/modprobe.d/blacklist.conf

Network isolation

linux

Restrict access to NVMe over TCP ports (typically 4420)

iptables -A INPUT -p tcp --dport 4420 -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="4420" protocol="tcp" reject'

🧯 If You Can't Patch

Implement strict network segmentation to isolate NVMe over TCP traffic
Monitor system logs for kernel panic or NULL pointer dereference messages

🔍 How to Verify

Check if Vulnerable:

Check if nvmet-tcp module is loaded: lsmod | grep nvmet_tcp

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commits or is newer than vulnerable versions

📡 Detection & Monitoring

Log Indicators:

Kernel NULL pointer dereference messages
BUG: kernel NULL pointer dereference
Oops: 0010
nvmet-tcp related crash logs

Network Indicators:

Unexpected TCP connection attempts to port 4420
Abnormal NVMe over TCP connection patterns

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "Oops: 0010") AND "nvmet"

📊 Metadata

CVE ID: CVE-2025-38035

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.03% exploit probability (8.7th percentile)

Published: June 18, 2025

Last Updated: December 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38035, you might also want to check these: