Skip to main content

Linux Kernel CVE-2025-68745

CRITICAL
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.1 MEDIUM

Local FC-hardware code path with a CPU-race trigger (AV:L, AC:H); requires privileged/kernel-adjacent conditions (PR:H); observable impact is a kernel panic (A:H) with no evidenced C/I loss.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
4.7 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:01 vuln.today
CVE Published
Dec 24, 2025 - 13:16 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Clear cmds after chip reset

Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems:

  1. Commands sent to FW, after chip reset got stuck and never freed as FW

is not going to respond to them anymore.

  1. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a

("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs().

So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds.

AnalysisAI

Kernel instability in the Linux qla2xxx SCSI driver (QLogic Fibre Channel target/host adapter) allows a chip-reset event to leave in-flight commands stuck and never freed, and can trigger a BUG_ON kernel panic (BUG_ON(cmd->sg_mapped) or BUG_ON(!valid_dma_direction(dir))) when two CPUs race to unmap the same scatter-gather list. This fix reverts commit 26f9ce53817a and partially reverts aefed3e5548f at __qla2x00_abort_all_cmds to restore correct command cleanup after a firmware/chip reset. No public exploit identified at time of analysis; the NVD-assigned CVSS of 9.8 (AV:N) is inconsistent with the local, hardware-dependent nature of the bug.

Technical ContextAI

The affected component is the qla2xxx driver, which supports QLogic 2xxx-series Fibre Channel Host Bus Adapters operating in both initiator and target (LIO/tcm_qla2xxx) modes within the Linux SCSI midlayer. The root cause is faulty command lifecycle management around a firmware chip reset: after the FW is reset it will no longer respond to previously submitted commands, so those commands must be explicitly aborted and freed in __qla2x00_abort_all_cmds(). Prior fixes (aefed3e5548f, then 26f9ce53817a) mishandled the scatter-gather DMA unmap path, leaving cmd->sg_mapped state inconsistent and creating a race in qlt_unmap_sg()/dma_unmap_sg_attrs() where concurrent callers on different CPUs pass an invalid DMA direction. This is a concurrency/state-management defect (unsynchronized double-unmap and leaked commands) rather than a classic memory-parsing bug; CWE is not assigned (N/A) in the source data.

Affected ProductsAI

The Linux kernel is affected specifically through the drivers/scsi/qla2xxx target/host code that carries the regressions from commit aefed3e5548f ('scsi: qla2xxx: target: Fix offline port handling and host reset handling') and commit 26f9ce53817a ('scsi: qla2xxx: Fix missed DMA unmap for aborted commands'); any stable kernel branch that backported those two commits is affected. No CPE strings or explicit version ranges were supplied in the input, so exact vulnerable kernel versions are not enumerated here - the fix is published as upstream stable commits at https://git.kernel.org/stable/c/5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936 and https://git.kernel.org/stable/c/d46c69a087aa3d1513f7a78f871b80251ea0c1ae. Only deployments using QLogic 2xxx Fibre Channel adapters (particularly in target mode) exercise this code path.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. Apply the stable-tree commits 5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936 and d46c69a087aa3d1513f7a78f871b80251ea0c1ae (https://git.kernel.org/stable/c/5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936 and https://git.kernel.org/stable/c/d46c69a087aa3d1513f7a78f871b80251ea0c1ae) by updating to the corresponding patched stable kernel release from your distribution once it ships, or rebuild the kernel with these commits backported. No exact released tag was provided in the input, so confirm the fixed version with your distribution's security tracker before scheduling. As a compensating control where patching must wait, restrict or avoid qla2xxx target-mode configurations and minimize conditions that force chip/FW resets (e.g., stabilize FC fabric links and avoid repeated adapter resets); note this reduces trigger frequency but does not remove the defect and may not be feasible for production FC storage targets that depend on this driver.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.1/baremetal-os-container:latest Container suse/sl-micro/6.1/base-os-container:latest Container suse/sl-micro/6.1/kvm-os-container:latest Container suse/sl-micro/6.1/rt-os-container:latest Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed

Share

CVE-2025-68745 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy