CVE-2025-68818

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"

This reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.

The commit being reverted added code to __qla2x00_abort_all_cmds() to

call sp->done() without holding a spinlock. But unlike the older code

below it, this new code failed to check sp->cmd_type and just assumed

TYPE_SRB, which results in a jump to an invalid pointer in target-mode

with TYPE_TGT_CMD:

qla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success

0000000009f7a79b

qla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h

mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h.

qla2xxx [0000:65:00.0]-d01e:8: -> fwdump no buffer

qla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event

0x8002 occurred

qla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -

ha=0000000058183fda.

BUG: kernel NULL pointer dereference, address: 000000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References