Bug 2425039 (CVE-2025-68745) - CVE-2025-68745 kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset
Summary: CVE-2025-68745 kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver...
Keywords:
Status: NEW
Alias: CVE-2025-68745
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-12-24 13:03 UTC by OSIDB Bzimport
Modified: 2026-10-30 13:06 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:66324 0 None None None 2026-09-10 05:18:34 UTC
Red Hat Product Errata RHSA-2026:66325 0 None None None 2026-09-10 05:39:52 UTC
Red Hat Product Errata RHSA-2026:67150 0 None None None 2026-09-14 13:35:27 UTC
Red Hat Product Errata RHSA-2026:67471 0 None None None 2026-09-15 06:14:15 UTC
Red Hat Product Errata RHSA-2026:85000 0 None None None 2026-10-19 12:38:41 UTC
Red Hat Product Errata RHSA-2026:88687 0 None None None 2026-10-23 13:39:13 UTC
Red Hat Product Errata RHSA-2026:91489 0 None None None 2026-10-28 01:09:50 UTC
Red Hat Product Errata RHSA-2026:91492 0 None None None 2026-10-28 01:14:21 UTC
Red Hat Product Errata RHSA-2026:91585 0 None None None 2026-10-28 07:07:08 UTC
Red Hat Product Errata RHSA-2026:92993 0 None None None 2026-10-30 06:30:18 UTC
Red Hat Product Errata RHSA-2026:92997 0 None None None 2026-10-30 07:34:43 UTC
Red Hat Product Errata RHSA-2026:93047 0 None None None 2026-10-30 13:06:04 UTC

Description OSIDB Bzimport 2025-12-24 13:03:55 UTC 
In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Clear cmds after chip reset

Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling
and host reset handling") caused two problems:

1. Commands sent to FW, after chip reset got stuck and never freed as FW
   is not going to respond to them anymore.

2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd().  Commit 26f9ce53817a
   ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands")
   attempted to fix this, but introduced another bug under different
   circumstances when two different CPUs were racing to call
   qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in
   dma_unmap_sg_attrs().

So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and
partially revert "scsi: qla2xxx: target: Fix offline port handling and
host reset handling" at __qla2x00_abort_all_cmds.
Comment 1 Alexander B 2025-12-25 06:57:22 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025122416-CVE-2025-68745-69b5@gregkh/T
Comment 6 errata-xmlrpc 2026-09-10 05:18:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:66324 https://access.redhat.com/errata/RHSA-2026:66324
Comment 7 errata-xmlrpc 2026-09-10 05:39:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:66325 https://access.redhat.com/errata/RHSA-2026:66325
Comment 8 Jon Orris 2026-09-14 13:35:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:67150 https://access.redhat.com/errata/RHSA-2026:67150
Comment 9 Jon Orris 2026-09-15 06:14:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:67471 https://access.redhat.com/errata/RHSA-2026:67471
Comment 12 Jon Orris 2026-10-19 12:38:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:85000 https://access.redhat.com/errata/RHSA-2026:85000
Comment 13 Jon Orris 2026-10-23 13:39:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:88687 https://access.redhat.com/errata/RHSA-2026:88687
Comment 16 Jon Orris 2026-10-28 01:09:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:91489 https://access.redhat.com/errata/RHSA-2026:91489
Comment 17 Jon Orris 2026-10-28 01:14:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:91492 https://access.redhat.com/errata/RHSA-2026:91492
Comment 18 Jon Orris 2026-10-28 07:07:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:91585 https://access.redhat.com/errata/RHSA-2026:91585
Comment 19 Jon Orris 2026-10-30 06:30:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:92993 https://access.redhat.com/errata/RHSA-2026:92993
Comment 20 Jon Orris 2026-10-30 07:34:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:92997 https://access.redhat.com/errata/RHSA-2026:92997
Comment 21 Jon Orris 2026-10-30 13:06:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:93047 https://access.redhat.com/errata/RHSA-2026:93047
Note You need to log in before you can comment on or make changes to this bug.