Skip to main content

Linux Kernel CVE-2025-68782

HIGH
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.5 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable via iSCSI target and no auth in the code path (PR:N), but the crash needs an allocation failure under memory pressure that cannot be forced on demand (AC:H); DoS only, so C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
3.3 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

8
Analysis Updated
Jul 30, 2026 - 07:29 vuln.today
v4 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:27 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:27 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.5 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 13, 2026 - 16:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Reset t_task_cdb pointer in error case

If allocation of cmd->t_task_cdb fails, it remains NULL but is later dereferenced in the 'err' path.

In case of error, reset NULL t_task_cdb value to point at the default fixed-size buffer.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

AnalysisAI

Remote denial of service in the Linux kernel SCSI target (LIO) subsystem allows an initiator to crash a storage server by triggering a NULL-pointer dereference on the command error path. When allocation of the per-command CDB buffer (cmd->t_task_cdb) fails, the pointer is left NULL yet subsequently dereferenced in the 'err' cleanup path, panicking the kernel. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-trigger memory-pressure condition rather than a reliably weaponizable flaw.

Technical ContextAI

The bug lives in the SCSI target core (target_core_transport) that backs the kernel's LIO framework, which exposes block devices as SCSI/iSCSI/FC/etc. targets. For each incoming SCSI command the target allocates storage for the Command Descriptor Block (CDB); large CDBs require a dynamic allocation into cmd->t_task_cdb rather than the default fixed-size inline buffer. The root cause is a classic CWE-476 NULL-pointer dereference: on allocation failure the code jumps to the error path without restoring t_task_cdb to the inline buffer, so later code dereferences NULL. The fix resets t_task_cdb to point at the default fixed-size buffer before the error path runs. The CWE was not populated in the feed (CWE: N/A) but the description unambiguously describes a NULL dereference.

Affected ProductsAI

The affected product is the mainline Linux kernel, specifically builds with the SCSI target (LIO / target_core_mod) subsystem, on systems configured to export storage as SCSI/iSCSI targets. Exact affected version ranges were not enumerated in the feed (no CPE strings provided); fixes are distributed across multiple stable branches as shown by the seven git.kernel.org stable commits (e.g. 0d36db68fdb8a3325386fd9523b67735f944e1f3 and 45fd86b444105c8bd07a763f58635c87e5dc7aea). Distribution exposure is confirmed by Ubuntu security notice USB tracking at https://ubuntu.com/security/notices/USN-8096-1, a VulDB entry at https://vuldb.com/?id.340668, and a Siemens ProductCERT advisory at https://cert-portal.siemens.com/productcert/html/ssa-019113.html for embedded/industrial products shipping affected kernels.

RemediationAI

Patch available per vendor advisory: apply your distribution's updated kernel that includes the upstream fix (the commit that resets t_task_cdb to the default fixed-size buffer on the error path); Ubuntu users should install the kernel from USN-8096-1 (https://ubuntu.com/security/notices/USN-8096-1) and Siemens product operators should follow SSA-019113 (https://cert-portal.siemens.com/productcert/html/ssa-019113.html). The upstream fixes are the stable commits at git.kernel.org (0260ad551b0815eb788d47f32899fbcd65d6f128, 0d36db68fdb8a3325386fd9523b67735f944e1f3, 45fd86b444105c8bd07a763f58635c87e5dc7aea, 5053eab38a4c4543522d0c320c639c56a8b59908, 6cac97b12bdab04832e0416d049efcd0d48d303b, 8727663ded659aad55eef21e3864ebf5a4796a96, 8edbb9e371af186b4cf40819dab65fafe109df4d). If patching must be deferred, a targeted compensating control is to restrict SCSI/iSCSI target exposure: enforce strict initiator ACLs and CHAP authentication in your target configuration, and firewall the iSCSI portal (TCP 3260) so only trusted initiators can reach it - the trade-off is that legitimate new initiators must be explicitly provisioned. Where the target functionality is unused, unload/disable the target_core_mod/LIO modules to eliminate the code path entirely; the side effect is loss of any SCSI-target export from that host.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2025-68782 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy