Skip to main content

Linux Kernel CVE-2025-68745

CRITICAL
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Access system with QLogic FC adapter
  2. Delivery
    Induce firmware/chip reset with commands in flight
  3. Exploit
    Concurrent qlt_unmap_sg on two CPUs
  4. Execution
    Hit BUG_ON invalid DMA direction
  5. Impact
    Kernel panic / storage node offline

Vulnerability Assessment

Exploitation Conditions

Triggering requires the system to be running the qla2xxx driver with QLogic 2xxx-series Fibre Channel hardware, and a firmware/chip reset event must occur while commands are outstanding; the BUG_ON(!valid_dma_direction) panic additionally requires two different CPUs to race into qlt_unmap_sg()/dma_unmap_sg_attrs() concurrently for the same command. Limiting factors: the affected code is not network-reachable in the sense the CVSS AV:N implies - it needs the specific FC adapter, target/host-reset conditions, and a narrow timing window for the race, so exploitation is opportunistic on hardware-specific deployments rather than remotely triggerable against a default configuration.
Impact

The scored signals are strongly contradictory and should be treated with caution. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) implies remote unauthenticated network compromise, but the actual defect is an internal driver code path triggered by a firmware/chip reset and a CPU-to-CPU race - there is no network-facing attack surface described, so the network vector appears to be an artifact of automated Linux-kernel CVE scoring rather than a validated assessment. No EPSS score, KEV listing, SSVC decision, or POC was provided; exploitation status is 'no public exploit identified at time of analysis.' The tag labels this 'Information Disclosure,' yet the described observable behavior is stuck commands (resource leak) and BUG_ON kernel panics (denial of service), with no evidence in the description of data leakage - verify the info-disclosure classification with the vendor. Realistically this is a reliability/availability defect on systems using QLogic FC hardware, not a broadly exploitable remote-code-execution priority; treat the 9.8 as inflated.
Exploit ScenarioDerived

On a Linux storage target using QLogic Fibre Channel adapters, a firmware or chip reset (from a fabric event, link flap, or induced adapter fault) occurs while commands are in flight; the driver fails to free them and two CPUs race through qlt_unmap_sg(), tripping a BUG_ON that panics the kernel and takes the storage node offline. No public exploit code is known, and reliable triggering requires local presence of the affected FC hardware plus precise timing of the concurrent unmap race, making practical weaponization difficult.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Kernel instability in the Linux qla2xxx SCSI driver (QLogic Fibre Channel target/host adapter) allows a chip-reset event to leave in-flight commands stuck and never freed, and can trigger a BUG_ON kernel panic (BUG_ON(cmd->sg_mapped) or BUG_ON(!valid_dma_direction(dir))) when two CPUs race to unmap the same scatter-gather list. This fix reverts commit 26f9ce53817a and partially reverts aefed3e5548f at __qla2x00_abort_all_cmds to restore correct command cleanup after a firmware/chip reset. No public exploit identified at time of analysis; the NVD-assigned CVSS of 9.8 (AV:N) is inconsistent with the local, hardware-dependent nature of the bug.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. Apply the stable-tree commits 5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936 and d46c69a087aa3d1513f7a78f871b80251ea0c1ae (https://git.kernel.org/stable/c/5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936 and https://git.kernel.org/stable/c/d46c69a087aa3d1513f7a78f871b80251ea0c1ae) by updating to the corresponding patched stable kernel release from your distribution once it ships, or rebuild the kernel with these commits backported. No exact released tag was provided in the input, so confirm the fixed version with your distribution's security tracker before scheduling. As a compensating control where patching must wait, restrict or avoid qla2xxx target-mode configurations and minimize conditions that force chip/FW resets (e.g., stabilize FC fabric links and avoid repeated adapter resets); note this reduces trigger frequency but does not remove the defect and may not be feasible for production FC storage targets that depend on this driver.

Affected ProductsAI

The Linux kernel is affected specifically through the drivers/scsi/qla2xxx target/host code that carries the regressions from commit aefed3e5548f ('scsi: qla2xxx: target: Fix offline port handling and host reset handling') and commit 26f9ce53817a ('scsi: qla2xxx: Fix missed DMA unmap for aborted commands'); any stable kernel branch that backported those two commits is affected. No CPE strings or explicit version ranges were supplied in the input, so exact vulnerable kernel versions are not enumerated here - the fix is published as upstream stable commits at https://git.kernel.org/stable/c/5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936 and https://git.kernel.org/stable/c/d46c69a087aa3d1513f7a78f871b80251ea0c1ae. Only deployments using QLogic 2xxx Fibre Channel adapters (particularly in target mode) exercise this code path.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the qla2xxx driver, which supports QLogic 2xxx-series Fibre Channel Host Bus Adapters operating in both initiator and target (LIO/tcm_qla2xxx) modes within the Linux SCSI midlayer. The root cause is faulty command lifecycle management around a firmware chip reset: after the FW is reset it will no longer respond to previously submitted commands, so those commands must be explicitly aborted and freed in __qla2x00_abort_all_cmds(). Prior fixes (aefed3e5548f, then 26f9ce53817a) mishandled the scatter-gather DMA unmap path, leaving cmd->sg_mapped state inconsistent and creating a race in qlt_unmap_sg()/dma_unmap_sg_attrs() where concurrent callers on different CPUs pass an invalid DMA direction. This is a concurrency/state-management defect (unsynchronized double-unmap and leaked commands) rather than a classic memory-parsing bug; CWE is not assigned (N/A) in the source data.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.1 MEDIUM

Local FC-hardware code path with a CPU-race trigger (AV:L, AC:H); requires privileged/kernel-adjacent conditions (PR:H); observable impact is a kernel panic (A:H) with no evidenced C/I loss.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 4.7 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Clear cmds after chip reset

Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems:

  1. Commands sent to FW, after chip reset got stuck and never freed as FW

is not going to respond to them anymore.

  1. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a

("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs().

So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds.

Executive ViewAI

Why It Matters

The Linux qla2xxx SCSI driver (used in QLogic Fibre Channel storage adapters) contains a critical kernel stability flaw that triggers system panics during firmware reset events, causing unplanned downtime for affected storage infrastructure. Organizations deploying QLogic adapters face immediate availability risk until a patch becomes available.

Business Impact: Severe
Compensating Controls

No interim mitigations identified. Organizations should: document systems requiring firmware resets, coordinate with QLogic/vendor on reset scheduling to minimize triggering events, and evaluate workload migration to non-affected storage infrastructure while awaiting vendor patches.

Threat Intelligence Overview

EPSS Score
0.1%
Top 95% exploitable
Prevalence
Low
qla2xxx QLogic Fibre Channel target driver, storage-appliance niche footprint
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.1/baremetal-os-container:latest Container suse/sl-micro/6.1/base-os-container:latest Container suse/sl-micro/6.1/kvm-os-container:latest Container suse/sl-micro/6.1/rt-os-container:latest Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/337952 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20838/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20873/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20931/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21284/ REF https://git.kernel.org/stable/c/0d0a1a267c1ee7c41aeffdca84afcb113787a91a REF https://git.kernel.org/stable/c/5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936 REF https://git.kernel.org/stable/c/c82c0fbb97d0fd44324eb55ab758408c7c964b32 REF https://git.kernel.org/stable/c/d46c69a087aa3d1513f7a78f871b80251ea0c1ae REF https://git.kernel.org/stable/c/e87e9f92d7735895b7dd97f53dce6d95d08cf29c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy