01 Record

CVE-2025-38035

nvmet-tcp: don't restore null sk_state_change

HighPUBLISHEDCNA: Linux

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

nvmet-tcp: don't restore null sk_state_change

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.49% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 39.8% of scored records. A rank, not a probability.
NVD base score: 5.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-07-30.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-06-18 09:33Z1 YR AGO

Last updated

2026-08-05 11:59Z1 MO AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-476NULL Pointer DereferenceBase

Data version

5.2

Document digest

d9ed643d1c4312d901762c0a16178b611fc21abe9c4c070756c764dcdc59141a

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux872d26a391da92ed8f0c0f5cb5fef428067b7f30 to < 6265538446e2426f4bf3b57e91d7680b2047ddd9, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to < 17e58be5b49f58bf17799a504f55c2d05ab2ecdc, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to < fc01b547c3f8bfa6e1d23cd5a2c63c736e8c3e4e, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to < c240375587ddcc80e1022f52ee32b946bbc3a639, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to < 3a982ada411b8c52695f1784c3f4784771f30209, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to < ec462449f4cf616b0aa2ed119f5f44b5fdfcefab, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to < a21cb31642ffc84ca4ce55028212a96f72f54d30, 872d26a391da92ed8f0c0f5cb5fef428067b7f30 to < 46d22b47df2741996af277a2838b95f130436c13, 5.0—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/6265538446e2426f4bf3b57e91d7680b2047ddd9
git.kernel.orghttps://git.kernel.org/stable/c/17e58be5b49f58bf17799a504f55c2d05ab2ecdc
git.kernel.orghttps://git.kernel.org/stable/c/fc01b547c3f8bfa6e1d23cd5a2c63c736e8c3e4e
git.kernel.orghttps://git.kernel.org/stable/c/c240375587ddcc80e1022f52ee32b946bbc3a639
git.kernel.orghttps://git.kernel.org/stable/c/3a982ada411b8c52695f1784c3f4784771f30209
git.kernel.orghttps://git.kernel.org/stable/c/ec462449f4cf616b0aa2ed119f5f44b5fdfcefab
git.kernel.orghttps://git.kernel.org/stable/c/a21cb31642ffc84ca4ce55028212a96f72f54d30
git.kernel.orghttps://git.kernel.org/stable/c/46d22b47df2741996af277a2838b95f130436c13
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

01 Record index

CVE-2025-38035

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2025-38035

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References