GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68818 (GCVE-0-2025-68818)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:29 – Updated: 2026-09-08 08:43
VLAI
Title
scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" This reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9. The commit being reverted added code to __qla2x00_abort_all_cmds() to call sp->done() without holding a spinlock. But unlike the older code below it, this new code failed to check sp->cmd_type and just assumed TYPE_SRB, which results in a jump to an invalid pointer in target-mode with TYPE_TGT_CMD: qla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success 0000000009f7a79b qla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h. qla2xxx [0000:65:00.0]-d01e:8: -> fwdump no buffer qla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event 0x8002 occurred qla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery - ha=0000000058183fda. BUG: kernel NULL pointer dereference, address: 0000000000000000 PF: supervisor instruction fetch in kernel mode PF: error_code(0x0010) - not-present page PGD 0 P4D 0 Oops: 0010 [#1] SMP CPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G O 6.1.133 #1 Hardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206 RAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000 RDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0 RBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045 R10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40 R13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400 FS: 0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die+0x4d/0x8b ? page_fault_oops+0x91/0x180 ? trace_buffer_unlock_commit_regs+0x38/0x1a0 ? exc_page_fault+0x391/0x5e0 ? asm_exc_page_fault+0x22/0x30 __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst] qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst] qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst] qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst] qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst] kthread+0xa8/0xd0 </TASK> Then commit 4475afa2646d ("scsi: qla2xxx: Complete command early within lock") added the spinlock back, because not having the lock caused a race and a crash. But qla2x00_abort_srb() in the switch below already checks for qla2x00_chip_is_down() and handles it the same way, so the code above the switch is now redundant and still buggy in target-mode. Remove it.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 231cfa78ec5badd84a1a2b09465bfad1a926aba1 , < b04b3733fff7e94566386b962e4795550fbdfd3d (git)
Affected: d6f7377528d2abf338e504126e44439541be8f7d , < 50b097d92c99f718831b8b349722bc79f718ba1b (git)
Affected: cd0a1804ac5bab2545ac700c8d0fe9ae9284c567 , < c5c37a821bd1708f26a9522b4a6f47b9f7a20003 (git)
Affected: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 , < e9e601b7df58ba0c667baf30263331df2c02ffe1 (git)
Affected: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 , < b10ebbfd59a535c8d22f4ede6e8389622ce98dc0 (git)
Affected: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 , < 1c728951bc769b795d377852eae1abddad88635d (git)
Affected: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 , < b57fbc88715b6d18f379463f48a15b560b087ffe (git)
Affected: 9189f20b4c5307c0998682bb522e481b4567a8b8 (git)
Affected: 415d614344a4f1bbddf55d724fc7eb9ef4b39aad (git)
Affected: 5.10.177 , < 5.10.248 (semver)
Affected: 5.15.105 , < 5.15.198 (semver)
Affected: 6.1.22 , < 6.1.160 (semver)
Affected: 5.4.240 , < 5.5 (semver)
Affected: 6.2.9 , < 6.3 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:43:37.663Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b04b3733fff7e94566386b962e4795550fbdfd3d",
              "status": "affected",
              "version": "231cfa78ec5badd84a1a2b09465bfad1a926aba1",
              "versionType": "git"
            },
            {
              "lessThan": "50b097d92c99f718831b8b349722bc79f718ba1b",
              "status": "affected",
              "version": "d6f7377528d2abf338e504126e44439541be8f7d",
              "versionType": "git"
            },
            {
              "lessThan": "c5c37a821bd1708f26a9522b4a6f47b9f7a20003",
              "status": "affected",
              "version": "cd0a1804ac5bab2545ac700c8d0fe9ae9284c567",
              "versionType": "git"
            },
            {
              "lessThan": "e9e601b7df58ba0c667baf30263331df2c02ffe1",
              "status": "affected",
              "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9",
              "versionType": "git"
            },
            {
              "lessThan": "b10ebbfd59a535c8d22f4ede6e8389622ce98dc0",
              "status": "affected",
              "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9",
              "versionType": "git"
            },
            {
              "lessThan": "1c728951bc769b795d377852eae1abddad88635d",
              "status": "affected",
              "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9",
              "versionType": "git"
            },
            {
              "lessThan": "b57fbc88715b6d18f379463f48a15b560b087ffe",
              "status": "affected",
              "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9189f20b4c5307c0998682bb522e481b4567a8b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "415d614344a4f1bbddf55d724fc7eb9ef4b39aad",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.248",
              "status": "affected",
              "version": "5.10.177",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.198",
              "status": "affected",
              "version": "5.15.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.160",
              "status": "affected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.240",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "5.10.177",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "5.15.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "6.1.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.240",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\"\n\nThis reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.\n\nThe commit being reverted added code to __qla2x00_abort_all_cmds() to\ncall sp-\u003edone() without holding a spinlock.  But unlike the older code\nbelow it, this new code failed to check sp-\u003ecmd_type and just assumed\nTYPE_SRB, which results in a jump to an invalid pointer in target-mode\nwith TYPE_TGT_CMD:\n\nqla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success\n  0000000009f7a79b\nqla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h\n  mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h.\nqla2xxx [0000:65:00.0]-d01e:8: -\u003e fwdump no buffer\nqla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event\n  0x8002 occurred\nqla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -\n  ha=0000000058183fda.\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPF: supervisor instruction fetch in kernel mode\nPF: error_code(0x0010) - not-present page\nPGD 0 P4D 0\nOops: 0010 [#1] SMP\nCPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G           O       6.1.133 #1\nHardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\nRSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206\nRAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000\nRDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0\nRBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045\nR10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40\nR13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400\nFS:  0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x4d/0x8b\n ? page_fault_oops+0x91/0x180\n ? trace_buffer_unlock_commit_regs+0x38/0x1a0\n ? exc_page_fault+0x391/0x5e0\n ? asm_exc_page_fault+0x22/0x30\n __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst]\n qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst]\n qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst]\n qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst]\n qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst]\n kthread+0xa8/0xd0\n \u003c/TASK\u003e\n\nThen commit 4475afa2646d (\"scsi: qla2xxx: Complete command early within\nlock\") added the spinlock back, because not having the lock caused a\nrace and a crash.  But qla2x00_abort_srb() in the switch below already\nchecks for qla2x00_chip_is_down() and handles it the same way, so the\ncode above the switch is now redundant and still buggy in target-mode.\nRemove it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - An attacker must send FCP traffic from the same Fibre Channel or FCoE fabric as the configured qla2xxx target, making this an adjacent logical-network attack.\nAC:L - An initiator can keep TYPE_TGT_CMD CTIOs outstanding while inducing reset handling through exchange-starvation or repeated ABTS/FCP traffic, so the attacker controls the necessary command and reset conditions.\nPR:N - Dynamic demo-mode node ACL generation is enabled by default, and even a login-only session can submit an unmapped-LUN command that queues a CHECK CONDITION CTIO without target credentials.\nUI:N - After the target is configured and active, malicious fabric traffic alone reaches the vulnerable abort path without victim action.\nS:U - The vulnerable qla2xxx driver and the affected kernel resources share the same security authority; kernel compromise does not itself cross a CVSS scope boundary.\nC:H - The TYPE_TGT_CMD-to-SRB confusion makes sp-\u003edone alias se_cmd.priv; with a pSCSI backend this can target request memory containing attacker-controlled CDB data, making kernel control-flow hijacking and arbitrary memory disclosure defensible.\nI:H - The attacker-influenced indirect call through backend-private command memory can potentially provide kernel code execution and arbitrary modification, rather than being limited to the observed NULL call.\nA:H - The demonstrated result is an invalid supervisor instruction fetch and kernel oops, and repeatable fabric traffic can crash or continually reset the storage target."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:45.852Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b04b3733fff7e94566386b962e4795550fbdfd3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/50b097d92c99f718831b8b349722bc79f718ba1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5c37a821bd1708f26a9522b4a6f47b9f7a20003"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9e601b7df58ba0c667baf30263331df2c02ffe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b10ebbfd59a535c8d22f4ede6e8389622ce98dc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c728951bc769b795d377852eae1abddad88635d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b57fbc88715b6d18f379463f48a15b560b087ffe"
        }
      ],
      "title": "scsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68818",
    "datePublished": "2026-01-13T15:29:22.018Z",
    "dateReserved": "2025-12-24T10:30:51.048Z",
    "dateUpdated": "2026-09-08T08:43:37.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68818",
      "date": "2026-09-17",
      "epss": "0.00293",
      "percentile": "0.22022"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68818\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:04.097\",\"lastModified\":\"2026-07-30T06:24:47.387\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: Revert \\\"scsi: qla2xxx: Perform lockless command completion in abort path\\\"\\n\\nThis reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.\\n\\nThe commit being reverted added code to __qla2x00_abort_all_cmds() to\\ncall sp-\u003edone() without holding a spinlock.  But unlike the older code\\nbelow it, this new code failed to check sp-\u003ecmd_type and just assumed\\nTYPE_SRB, which results in a jump to an invalid pointer in target-mode\\nwith TYPE_TGT_CMD:\\n\\nqla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success\\n  0000000009f7a79b\\nqla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h\\n  mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h.\\nqla2xxx [0000:65:00.0]-d01e:8: -\u003e fwdump no buffer\\nqla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event\\n  0x8002 occurred\\nqla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -\\n  ha=0000000058183fda.\\nBUG: kernel NULL pointer dereference, address: 0000000000000000\\nPF: supervisor instruction fetch in kernel mode\\nPF: error_code(0x0010) - not-present page\\nPGD 0 P4D 0\\nOops: 0010 [#1] SMP\\nCPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G           O       6.1.133 #1\\nHardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023\\nRIP: 0010:0x0\\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\\nRSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206\\nRAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000\\nRDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0\\nRBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045\\nR10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40\\nR13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400\\nFS:  0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cTASK\u003e\\n ? __die+0x4d/0x8b\\n ? page_fault_oops+0x91/0x180\\n ? trace_buffer_unlock_commit_regs+0x38/0x1a0\\n ? exc_page_fault+0x391/0x5e0\\n ? asm_exc_page_fault+0x22/0x30\\n __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst]\\n qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst]\\n qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst]\\n qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst]\\n qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst]\\n kthread+0xa8/0xd0\\n \u003c/TASK\u003e\\n\\nThen commit 4475afa2646d (\\\"scsi: qla2xxx: Complete command early within\\nlock\\\") added the spinlock back, because not having the lock caused a\\nrace and a crash.  But qla2x00_abort_srb() in the switch below already\\nchecks for qla2x00_chip_is_down() and handles it the same way, so the\\ncode above the switch is now redundant and still buggy in target-mode.\\nRemove it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nscsi: Revertir \\\"scsi: qla2xxx: Realizar la finalizaci\u00f3n de comandos sin bloqueo en la ruta de aborto\\\"\\n\\nEsto revierte el commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.\\n\\nEl commit que se revierte a\u00f1adi\u00f3 c\u00f3digo a __qla2x00_abort_all_cmds() para llamar a sp-\u0026gt;done() sin mantener un spinlock. Pero a diferencia del c\u00f3digo anterior debajo de \u00e9l, este nuevo c\u00f3digo no verific\u00f3 sp-\u0026gt;cmd_type y simplemente asumi\u00f3 TYPE_SRB, lo que resulta en un salto a un puntero inv\u00e1lido en modo objetivo con TYPE_TGT_CMD:\\n\\nqla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success\\n  0000000009f7a79b\\nqla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h\\n  mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h.\\nqla2xxx [0000:65:00.0]-d01e:8: -\u0026gt; fwdump no buffer\\nqla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event\\n  0x8002 occurred\\nqla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -\\n  ha=0000000058183fda.\\nBUG: kernel NULL pointer dereference, address: 0000000000000000\\nPF: supervisor instruction fetch in kernel mode\\nPF: error_code(0x0010) - not-present page\\nPGD 0 P4D 0\\nOops: 0010 [#1] SMP\\nCPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G           O       6.1.133 #1\\nHardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023\\nRIP: 0010:0x0\\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\\nRSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206\\nRAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000\\nRDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0\\nRBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045\\nR10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40\\nR13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400\\nFS:  0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \\n ? __die+0x4d/0x8b\\n ? page_fault_oops+0x91/0x180\\n ? trace_buffer_unlock_commit_regs+0x38/0x1a0\\n ? exc_page_fault+0x391/0x5e0\\n ? asm_exc_page_fault+0x22/0x30\\n __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst]\\n qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst]\\n qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst]\\n qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst]\\n qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst]\\n kthread+0xa8/0xd0\\n \\n\\nLuego el commit 4475afa2646d (\u0027scsi: qla2xxx: Completar comando temprano dentro del bloqueo\u0027) a\u00f1adi\u00f3 el spinlock de nuevo, porque no tener el bloqueo caus\u00f3 una condici\u00f3n de carrera y un fallo. Pero qla2x00_abort_srb() en el switch de abajo ya verifica qla2x00_chip_is_down() y lo maneja de la misma manera, por lo que el c\u00f3digo encima del switch es ahora redundante y sigue siendo defectuoso en modo objetivo. Elim\u00ednelo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"231cfa78ec5badd84a1a2b09465bfad1a926aba1\",\"lessThan\":\"b04b3733fff7e94566386b962e4795550fbdfd3d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6f7377528d2abf338e504126e44439541be8f7d\",\"lessThan\":\"50b097d92c99f718831b8b349722bc79f718ba1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cd0a1804ac5bab2545ac700c8d0fe9ae9284c567\",\"lessThan\":\"c5c37a821bd1708f26a9522b4a6f47b9f7a20003\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0367076b0817d5c75dfb83001ce7ce5c64d803a9\",\"lessThan\":\"e9e601b7df58ba0c667baf30263331df2c02ffe1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0367076b0817d5c75dfb83001ce7ce5c64d803a9\",\"lessThan\":\"b10ebbfd59a535c8d22f4ede6e8389622ce98dc0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0367076b0817d5c75dfb83001ce7ce5c64d803a9\",\"lessThan\":\"1c728951bc769b795d377852eae1abddad88635d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0367076b0817d5c75dfb83001ce7ce5c64d803a9\",\"lessThan\":\"b57fbc88715b6d18f379463f48a15b560b087ffe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9189f20b4c5307c0998682bb522e481b4567a8b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"415d614344a4f1bbddf55d724fc7eb9ef4b39aad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.177\",\"lessThan\":\"5.10.248\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.105\",\"lessThan\":\"5.15.198\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.22\",\"lessThan\":\"6.1.160\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.240\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.2.9\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.160\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.120\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1c728951bc769b795d377852eae1abddad88635d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/50b097d92c99f718831b8b349722bc79f718ba1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b04b3733fff7e94566386b962e4795550fbdfd3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b10ebbfd59a535c8d22f4ede6e8389622ce98dc0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b57fbc88715b6d18f379463f48a15b560b087ffe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c5c37a821bd1708f26a9522b4a6f47b9f7a20003\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e9e601b7df58ba0c667baf30263331df2c02ffe1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-14T18:51:14+00:00",
      "cve": "CVE-2025-68818",
      "id": "CVE-2025-68818",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\"",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68818.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.