Skip to main content

Linux Kernel CVE-2025-68741

CRITICAL
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Requires Fibre Channel fabric adjacency (AV:A) and hitting a specific error path (AC:H); most realistic impact is heap corruption causing DoS (A:H), with C/I unproven so set to N.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.0 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Red Hat
7.3 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:01 vuln.today
CVE Published
Dec 24, 2025 - 13:16 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix improper freeing of purex item

In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item().

The qla24xx_alloc_purex_item() function may return a pre-allocated item from a per-adapter pool for small allocations, instead of dynamically allocating memory with kzalloc().

An error handling path in qla2xxx_process_purls_iocb() incorrectly uses kfree() to release the item. If the item was from the pre-allocated pool, calling kfree() on it is a bug that can lead to memory corruption.

Fix this by using the correct deallocation function, qla24xx_free_purex_item(), which properly handles both dynamically allocated and pre-allocated items.

AnalysisAI

Memory corruption in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver arises from an error-handling path in qla2xxx_process_purls_iocb() that calls kfree() on a purex item which may have originated from a per-adapter pre-allocated pool rather than kzalloc(). Freeing a pool-backed object with kfree() can corrupt kernel heap state. The fix routes deallocation through qla24xx_free_purex_item(), which correctly distinguishes dynamically allocated from pooled items; no public exploit identified at time of analysis, and the issue is not in CISA KEV.

Technical ContextAI

The affected component is the qla2xxx driver, the in-tree Linux kernel driver for QLogic/Marvell Fibre Channel Host Bus Adapters. PUREX (unsolicited ELS/purex IOCB) frames received from the Fibre Channel fabric are processed via qla2xxx_process_purls_iocb(), which allocates a tracking item through qla27xx_copy_multiple_pkt() -> qla24xx_alloc_purex_item(). That allocator returns a small item from a fixed per-adapter pool when the payload is small, otherwise it uses kzalloc(). The bug is a deallocation-function mismatch: the error path unconditionally calls kfree() on an object that may be pool-owned, so the general-purpose slab allocator is asked to free memory it never dispensed. This is a memory-management/allocator-mismatch defect (CWE-like class: use of incorrect free/invalid free leading to memory corruption); the 'Buffer Overflow' tag in the input is a mislabel - the root cause is improper freeing, not an out-of-bounds write.

Affected ProductsAI

The Linux kernel is affected specifically in the qla2xxx SCSI Fibre Channel driver (drivers/scsi/qla2xxx). No exact affected/fixed kernel version numbers were provided in the input; the fix is distributed as stable-tree commits at git.kernel.org (4bccd506a1f1ab01d1f45b2a3effff6bedc73cf9, 5fa1c8226b4532ad7011d295d3ab4ad45df105ae, 78b1a242fe612a755f2158fd206ee6bb577d18ca, 8e9f0a0717ba31d5842721627ade1e62d7aec012, cfe3e2f768d248fd3d965d561d0768a56dd0b9f8), indicating backports across multiple stable branches. Only systems using QLogic/Marvell Fibre Channel HBAs served by qla2xxx are exposed; kernels without this driver loaded are not practically affected.

RemediationAI

Upstream fix available (multiple stable commits); a released patched tagged version was not specified in the input, so apply the distribution kernel update that incorporates the referenced commits (4bccd506, 5fa1c822, 78b1a242, 8e9f0a07, cfe3e2f7 from git.kernel.org/stable) or rebuild from a stable branch containing them. Where immediate patching is not possible on Fibre Channel storage hosts, reduce exposure by unloading the qla2xxx module on systems that do not require FC connectivity (side effect: disables all QLogic FC storage paths, so unsafe on SAN-booted or FC-dependent hosts), and by tightening SAN zoning/fabric access so only trusted, known peers can send frames to the HBA (side effect: operational overhead and risk of breaking legitimate initiator/target relationships if zoning is misconfigured). There is no application-layer workaround since the defect is in kernel frame processing; kernel replacement is the definitive fix.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed

Share

CVE-2025-68741 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy