High · published July 25, 2025
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
The function core_scsi3_decode_spec_i_port(), in its error code path,
unconditionally calls core_scsi3_lunacl_undepend_item() passing the
dest_se_deve pointer, which may be NULL.
This can lead to a NULL pointer dereference if dest_se_deve remains
unset.
SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg
Unable to handle kernel paging request at virtual address dfff800000000012
Call trace:
core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)
core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]
core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]
target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]
Fix this by adding a NULL check before calling
core_scsi3_lunacl_undepend_item()
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.9, < 5.10.240 | 5.10.240 |
| linux/linux_kernel | ≥ 5.11, < 5.15.187 | 5.15.187 |
| linux/linux_kernel | ≥ 5.16, < 6.1.144 | 6.1.144 |
| linux/linux_kernel | ≥ 6.2, < 6.6.97 | 6.6.97 |
| linux/linux_kernel | ≥ 6.7, < 6.12.37 | 6.12.37 |
| linux/linux_kernel | ≥ 6.13, < 6.15.6 | 6.15.6 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| debian/debian_linux | all versions | — |