CVE-2025-68371

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: smartpqi: Fix device resources accessed after device removal

Correct possible race conditions during device removal.

Previously, a scheduled work item to reset a LUN could still execute

after the device was removed, leading to use-after-free and other

resource access issues.

This race condition occurs because the abort handler may schedule a LUN

reset concurrently with device removal via sdev_destroy(), leading to

use-after-free and improper access to freed resources.

- Check in the device reset handler if the device is still present in

the controller's SCSI device list before running; if not, the reset

is skipped.

- Cancel any pending TMF work that has not started in sdev_destroy().

- Ensure device freeing in sdev_destroy() is done while holding the

LUN reset mutex to avoid races with ongoing resets.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References