GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68745 (GCVE-0-2025-68745)

Vulnerability from cvelistv5 – Published: 2025-12-24 12:09 – Updated: 2026-08-05 12:11
VLAI
Title
scsi: qla2xxx: Clear cmds after chip reset
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems: 1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore. 2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs(). So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aefed3e5548f28e5fecafda6604fcbc65484dbaa , < 5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936 (git)
Affected: aefed3e5548f28e5fecafda6604fcbc65484dbaa , < d46c69a087aa3d1513f7a78f871b80251ea0c1ae (git)
Affected: eb67b7a23d357f578578e737cb6412ae2384f352 (git)
Affected: ec9639d92c1e10d4bc667e842753d85e21683d5c (git)
Affected: e6e957f552d5b696879a31e5b0e2a9120e1ea86e (git)
Affected: 4.9.316 , < 4.10 (semver)
Affected: 4.14.281 , < 4.15 (semver)
Affected: 4.19.245 , < 4.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 6.18.2 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c",
            "drivers/scsi/qla2xxx/qla_target.c",
            "drivers/scsi/qla2xxx/qla_target.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936",
              "status": "affected",
              "version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
              "versionType": "git"
            },
            {
              "lessThan": "d46c69a087aa3d1513f7a78f871b80251ea0c1ae",
              "status": "affected",
              "version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eb67b7a23d357f578578e737cb6412ae2384f352",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ec9639d92c1e10d4bc667e842753d85e21683d5c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6e957f552d5b696879a31e5b0e2a9120e1ea86e",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.316",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.281",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.245",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c",
            "drivers/scsi/qla2xxx/qla_target.c",
            "drivers/scsi/qla2xxx/qla_target.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.316",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.281",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.245",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Clear cmds after chip reset\n\nCommit aefed3e5548f (\"scsi: qla2xxx: target: Fix offline port handling\nand host reset handling\") caused two problems:\n\n1. Commands sent to FW, after chip reset got stuck and never freed as FW\n   is not going to respond to them anymore.\n\n2. BUG_ON(cmd-\u003esg_mapped) in qlt_free_cmd().  Commit 26f9ce53817a\n   (\"scsi: qla2xxx: Fix missed DMA unmap for aborted commands\")\n   attempted to fix this, but introduced another bug under different\n   circumstances when two different CPUs were racing to call\n   qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in\n   dma_unmap_sg_attrs().\n\nSo revert \"scsi: qla2xxx: Fix missed DMA unmap for aborted commands\" and\npartially revert \"scsi: qla2xxx: target: Fix offline port handling and\nhost reset handling\" at __qla2x00_abort_all_cmds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote Fibre Channel/FCoE initiator can reach the vulnerable command lifecycle by sending FCP I/O and ABTS/TMR frames, without local host access.\nAC:L - The initiator can keep large PI/DIF I/O active while repeatedly issuing abort or reset requests, controlling both sides of the abort-versus-completion race.\nPR:N - Dynamic/demo ACL configurations admit fabric initiators without credentials, and WWPN-based session establishment requires no privilege on the target host.\nUI:N - Exploitation requires only attacker-generated fabric traffic and no victim action during the attack.\nS:U - The vulnerable driver and the affected kernel memory and storage resources belong to the same security authority.\nC:H - Concurrent unmapping can double-free shared DIF CRC-context and DSD objects, producing overlapping firmware-visible DMA contexts that can expose kernel or cross-command data.\nI:H - The DMA-pool double-free and concurrent DSD list deletion can corrupt kernel memory or redirect device DMA, potentially enabling arbitrary modification or code execution.\nA:H - The reported paths reach kernel BUG assertions, while reset-time command leaks can permanently exhaust resources; either can crash or render the target unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:14.649Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936"
        },
        {
          "url": "https://git.kernel.org/stable/c/d46c69a087aa3d1513f7a78f871b80251ea0c1ae"
        }
      ],
      "title": "scsi: qla2xxx: Clear cmds after chip reset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68745",
    "datePublished": "2025-12-24T12:09:41.517Z",
    "dateReserved": "2025-12-24T10:30:51.031Z",
    "dateUpdated": "2026-08-05T12:11:14.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68745",
      "date": "2026-09-16",
      "epss": "0.00361",
      "percentile": "0.29631"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:56:09.000Z",
      "cve": "CVE-2025-68745",
      "id": "msrc_CVE-2025-68745",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:known_affected": "12",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: qla2xxx: Clear cmds after chip reset",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-68745.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68745\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:29.440\",\"lastModified\":\"2026-07-30T06:24:42.167\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Clear cmds after chip reset\\n\\nCommit aefed3e5548f (\\\"scsi: qla2xxx: target: Fix offline port handling\\nand host reset handling\\\") caused two problems:\\n\\n1. Commands sent to FW, after chip reset got stuck and never freed as FW\\n   is not going to respond to them anymore.\\n\\n2. BUG_ON(cmd-\u003esg_mapped) in qlt_free_cmd().  Commit 26f9ce53817a\\n   (\\\"scsi: qla2xxx: Fix missed DMA unmap for aborted commands\\\")\\n   attempted to fix this, but introduced another bug under different\\n   circumstances when two different CPUs were racing to call\\n   qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in\\n   dma_unmap_sg_attrs().\\n\\nSo revert \\\"scsi: qla2xxx: Fix missed DMA unmap for aborted commands\\\" and\\npartially revert \\\"scsi: qla2xxx: target: Fix offline port handling and\\nhost reset handling\\\" at __qla2x00_abort_all_cmds.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\",\"drivers/scsi/qla2xxx/qla_target.c\",\"drivers/scsi/qla2xxx/qla_target.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"aefed3e5548f28e5fecafda6604fcbc65484dbaa\",\"lessThan\":\"5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aefed3e5548f28e5fecafda6604fcbc65484dbaa\",\"lessThan\":\"d46c69a087aa3d1513f7a78f871b80251ea0c1ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eb67b7a23d357f578578e737cb6412ae2384f352\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec9639d92c1e10d4bc667e842753d85e21683d5c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e6e957f552d5b696879a31e5b0e2a9120e1ea86e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.9.316\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.281\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.245\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\",\"drivers/scsi/qla2xxx/qla_target.c\",\"drivers/scsi/qla2xxx/qla_target.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.2\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d46c69a087aa3d1513f7a78f871b80251ea0c1ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T11:38:31+00:00",
      "cve": "CVE-2025-68745",
      "id": "CVE-2025-68745",
      "initial_release_date": "2025-12-24T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "36",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68745.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:44:24Z",
      "cve": "CVE-2025-68745",
      "id": "CVE-2025-68745",
      "initial_release_date": "2025-12-25T00:23:25Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "447",
      "product_status:known_not_affected": "36",
      "product_status:recommended": "198",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68745",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68745.json",
      "version": "27"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.