CVE-2025-68818 (GCVE-0-2025-68818)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:29 – Updated: 2026-07-14 12:44
VLAI
Title
scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" This reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9. The commit being reverted added code to __qla2x00_abort_all_cmds() to call sp->done() without holding a spinlock. But unlike the older code below it, this new code failed to check sp->cmd_type and just assumed TYPE_SRB, which results in a jump to an invalid pointer in target-mode with TYPE_TGT_CMD: qla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success 0000000009f7a79b qla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h. qla2xxx [0000:65:00.0]-d01e:8: -> fwdump no buffer qla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event 0x8002 occurred qla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery - ha=0000000058183fda. BUG: kernel NULL pointer dereference, address: 0000000000000000 PF: supervisor instruction fetch in kernel mode PF: error_code(0x0010) - not-present page PGD 0 P4D 0 Oops: 0010 [#1] SMP CPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G O 6.1.133 #1 Hardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206 RAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000 RDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0 RBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045 R10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40 R13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400 FS: 0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die+0x4d/0x8b ? page_fault_oops+0x91/0x180 ? trace_buffer_unlock_commit_regs+0x38/0x1a0 ? exc_page_fault+0x391/0x5e0 ? asm_exc_page_fault+0x22/0x30 __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst] qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst] qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst] qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst] qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst] kthread+0xa8/0xd0 </TASK> Then commit 4475afa2646d ("scsi: qla2xxx: Complete command early within lock") added the spinlock back, because not having the lock caused a race and a crash. But qla2x00_abort_srb() in the switch below already checks for qla2x00_chip_is_down() and handles it the same way, so the code above the switch is now redundant and still buggy in target-mode. Remove it.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 231cfa78ec5badd84a1a2b09465bfad1a926aba1 , < b04b3733fff7e94566386b962e4795550fbdfd3d (git)
Affected: d6f7377528d2abf338e504126e44439541be8f7d , < 50b097d92c99f718831b8b349722bc79f718ba1b (git)
Affected: cd0a1804ac5bab2545ac700c8d0fe9ae9284c567 , < c5c37a821bd1708f26a9522b4a6f47b9f7a20003 (git)
Affected: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 , < e9e601b7df58ba0c667baf30263331df2c02ffe1 (git)
Affected: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 , < b10ebbfd59a535c8d22f4ede6e8389622ce98dc0 (git)
Affected: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 , < 1c728951bc769b795d377852eae1abddad88635d (git)
Affected: 0367076b0817d5c75dfb83001ce7ce5c64d803a9 , < b57fbc88715b6d18f379463f48a15b560b087ffe (git)
Affected: 9189f20b4c5307c0998682bb522e481b4567a8b8 (git)
Affected: 415d614344a4f1bbddf55d724fc7eb9ef4b39aad (git)
Affected: 5.10.177 , < 5.10.248 (semver)
Affected: 5.15.105 , < 5.15.198 (semver)
Affected: 6.1.22 , < 6.1.160 (semver)
Affected: 5.4.240 , < 5.5 (semver)
Affected: 6.2.9 , < 6.3 (semver)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:44:24.395Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b04b3733fff7e94566386b962e4795550fbdfd3d",
              "status": "affected",
              "version": "231cfa78ec5badd84a1a2b09465bfad1a926aba1",
              "versionType": "git"
            },
            {
              "lessThan": "50b097d92c99f718831b8b349722bc79f718ba1b",
              "status": "affected",
              "version": "d6f7377528d2abf338e504126e44439541be8f7d",
              "versionType": "git"
            },
            {
              "lessThan": "c5c37a821bd1708f26a9522b4a6f47b9f7a20003",
              "status": "affected",
              "version": "cd0a1804ac5bab2545ac700c8d0fe9ae9284c567",
              "versionType": "git"
            },
            {
              "lessThan": "e9e601b7df58ba0c667baf30263331df2c02ffe1",
              "status": "affected",
              "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9",
              "versionType": "git"
            },
            {
              "lessThan": "b10ebbfd59a535c8d22f4ede6e8389622ce98dc0",
              "status": "affected",
              "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9",
              "versionType": "git"
            },
            {
              "lessThan": "1c728951bc769b795d377852eae1abddad88635d",
              "status": "affected",
              "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9",
              "versionType": "git"
            },
            {
              "lessThan": "b57fbc88715b6d18f379463f48a15b560b087ffe",
              "status": "affected",
              "version": "0367076b0817d5c75dfb83001ce7ce5c64d803a9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9189f20b4c5307c0998682bb522e481b4567a8b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "415d614344a4f1bbddf55d724fc7eb9ef4b39aad",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.248",
              "status": "affected",
              "version": "5.10.177",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.198",
              "status": "affected",
              "version": "5.15.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.160",
              "status": "affected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.240",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "5.10.177",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "5.15.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "6.1.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.240",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\"\n\nThis reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.\n\nThe commit being reverted added code to __qla2x00_abort_all_cmds() to\ncall sp-\u003edone() without holding a spinlock.  But unlike the older code\nbelow it, this new code failed to check sp-\u003ecmd_type and just assumed\nTYPE_SRB, which results in a jump to an invalid pointer in target-mode\nwith TYPE_TGT_CMD:\n\nqla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success\n  0000000009f7a79b\nqla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h\n  mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h.\nqla2xxx [0000:65:00.0]-d01e:8: -\u003e fwdump no buffer\nqla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event\n  0x8002 occurred\nqla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -\n  ha=0000000058183fda.\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPF: supervisor instruction fetch in kernel mode\nPF: error_code(0x0010) - not-present page\nPGD 0 P4D 0\nOops: 0010 [#1] SMP\nCPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G           O       6.1.133 #1\nHardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\nRSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206\nRAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000\nRDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0\nRBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045\nR10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40\nR13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400\nFS:  0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x4d/0x8b\n ? page_fault_oops+0x91/0x180\n ? trace_buffer_unlock_commit_regs+0x38/0x1a0\n ? exc_page_fault+0x391/0x5e0\n ? asm_exc_page_fault+0x22/0x30\n __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst]\n qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst]\n qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst]\n qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst]\n qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst]\n kthread+0xa8/0xd0\n \u003c/TASK\u003e\n\nThen commit 4475afa2646d (\"scsi: qla2xxx: Complete command early within\nlock\") added the spinlock back, because not having the lock caused a\nrace and a crash.  But qla2x00_abort_srb() in the switch below already\nchecks for qla2x00_chip_is_down() and handles it the same way, so the\ncode above the switch is now redundant and still buggy in target-mode.\nRemove it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:02:58.491Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b04b3733fff7e94566386b962e4795550fbdfd3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/50b097d92c99f718831b8b349722bc79f718ba1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5c37a821bd1708f26a9522b4a6f47b9f7a20003"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9e601b7df58ba0c667baf30263331df2c02ffe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b10ebbfd59a535c8d22f4ede6e8389622ce98dc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c728951bc769b795d377852eae1abddad88635d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b57fbc88715b6d18f379463f48a15b560b087ffe"
        }
      ],
      "title": "scsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68818",
    "datePublished": "2026-01-13T15:29:22.018Z",
    "dateReserved": "2025-12-24T10:30:51.048Z",
    "dateUpdated": "2026-07-14T12:44:24.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68818",
      "date": "2026-07-24",
      "epss": "0.00177",
      "percentile": "0.07428"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68818\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:04.097\",\"lastModified\":\"2026-07-14T13:18:01.110\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: Revert \\\"scsi: qla2xxx: Perform lockless command completion in abort path\\\"\\n\\nThis reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.\\n\\nThe commit being reverted added code to __qla2x00_abort_all_cmds() to\\ncall sp-\u003edone() without holding a spinlock.  But unlike the older code\\nbelow it, this new code failed to check sp-\u003ecmd_type and just assumed\\nTYPE_SRB, which results in a jump to an invalid pointer in target-mode\\nwith TYPE_TGT_CMD:\\n\\nqla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success\\n  0000000009f7a79b\\nqla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h\\n  mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h.\\nqla2xxx [0000:65:00.0]-d01e:8: -\u003e fwdump no buffer\\nqla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event\\n  0x8002 occurred\\nqla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -\\n  ha=0000000058183fda.\\nBUG: kernel NULL pointer dereference, address: 0000000000000000\\nPF: supervisor instruction fetch in kernel mode\\nPF: error_code(0x0010) - not-present page\\nPGD 0 P4D 0\\nOops: 0010 [#1] SMP\\nCPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G           O       6.1.133 #1\\nHardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023\\nRIP: 0010:0x0\\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\\nRSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206\\nRAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000\\nRDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0\\nRBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045\\nR10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40\\nR13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400\\nFS:  0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cTASK\u003e\\n ? __die+0x4d/0x8b\\n ? page_fault_oops+0x91/0x180\\n ? trace_buffer_unlock_commit_regs+0x38/0x1a0\\n ? exc_page_fault+0x391/0x5e0\\n ? asm_exc_page_fault+0x22/0x30\\n __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst]\\n qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst]\\n qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst]\\n qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst]\\n qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst]\\n kthread+0xa8/0xd0\\n \u003c/TASK\u003e\\n\\nThen commit 4475afa2646d (\\\"scsi: qla2xxx: Complete command early within\\nlock\\\") added the spinlock back, because not having the lock caused a\\nrace and a crash.  But qla2x00_abort_srb() in the switch below already\\nchecks for qla2x00_chip_is_down() and handles it the same way, so the\\ncode above the switch is now redundant and still buggy in target-mode.\\nRemove it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nscsi: Revertir \\\"scsi: qla2xxx: Realizar la finalizaci\u00f3n de comandos sin bloqueo en la ruta de aborto\\\"\\n\\nEsto revierte el commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.\\n\\nEl commit que se revierte a\u00f1adi\u00f3 c\u00f3digo a __qla2x00_abort_all_cmds() para llamar a sp-\u0026gt;done() sin mantener un spinlock. Pero a diferencia del c\u00f3digo anterior debajo de \u00e9l, este nuevo c\u00f3digo no verific\u00f3 sp-\u0026gt;cmd_type y simplemente asumi\u00f3 TYPE_SRB, lo que resulta en un salto a un puntero inv\u00e1lido en modo objetivo con TYPE_TGT_CMD:\\n\\nqla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success\\n  0000000009f7a79b\\nqla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h\\n  mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h.\\nqla2xxx [0000:65:00.0]-d01e:8: -\u0026gt; fwdump no buffer\\nqla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event\\n  0x8002 occurred\\nqla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -\\n  ha=0000000058183fda.\\nBUG: kernel NULL pointer dereference, address: 0000000000000000\\nPF: supervisor instruction fetch in kernel mode\\nPF: error_code(0x0010) - not-present page\\nPGD 0 P4D 0\\nOops: 0010 [#1] SMP\\nCPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G           O       6.1.133 #1\\nHardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023\\nRIP: 0010:0x0\\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\\nRSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206\\nRAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000\\nRDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0\\nRBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045\\nR10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40\\nR13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400\\nFS:  0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \\n ? __die+0x4d/0x8b\\n ? page_fault_oops+0x91/0x180\\n ? trace_buffer_unlock_commit_regs+0x38/0x1a0\\n ? exc_page_fault+0x391/0x5e0\\n ? asm_exc_page_fault+0x22/0x30\\n __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst]\\n qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst]\\n qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst]\\n qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst]\\n qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst]\\n kthread+0xa8/0xd0\\n \\n\\nLuego el commit 4475afa2646d (\u0027scsi: qla2xxx: Completar comando temprano dentro del bloqueo\u0027) a\u00f1adi\u00f3 el spinlock de nuevo, porque no tener el bloqueo caus\u00f3 una condici\u00f3n de carrera y un fallo. Pero qla2x00_abort_srb() en el switch de abajo ya verifica qla2x00_chip_is_down() y lo maneja de la misma manera, por lo que el c\u00f3digo encima del switch es ahora redundante y sigue siendo defectuoso en modo objetivo. Elim\u00ednelo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"231cfa78ec5badd84a1a2b09465bfad1a926aba1\",\"lessThan\":\"b04b3733fff7e94566386b962e4795550fbdfd3d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d6f7377528d2abf338e504126e44439541be8f7d\",\"lessThan\":\"50b097d92c99f718831b8b349722bc79f718ba1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cd0a1804ac5bab2545ac700c8d0fe9ae9284c567\",\"lessThan\":\"c5c37a821bd1708f26a9522b4a6f47b9f7a20003\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0367076b0817d5c75dfb83001ce7ce5c64d803a9\",\"lessThan\":\"e9e601b7df58ba0c667baf30263331df2c02ffe1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0367076b0817d5c75dfb83001ce7ce5c64d803a9\",\"lessThan\":\"b10ebbfd59a535c8d22f4ede6e8389622ce98dc0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0367076b0817d5c75dfb83001ce7ce5c64d803a9\",\"lessThan\":\"1c728951bc769b795d377852eae1abddad88635d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0367076b0817d5c75dfb83001ce7ce5c64d803a9\",\"lessThan\":\"b57fbc88715b6d18f379463f48a15b560b087ffe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9189f20b4c5307c0998682bb522e481b4567a8b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"415d614344a4f1bbddf55d724fc7eb9ef4b39aad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.177\",\"lessThan\":\"5.10.248\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.105\",\"lessThan\":\"5.15.198\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.22\",\"lessThan\":\"6.1.160\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.240\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.2.9\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.160\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.120\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1c728951bc769b795d377852eae1abddad88635d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/50b097d92c99f718831b8b349722bc79f718ba1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b04b3733fff7e94566386b962e4795550fbdfd3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b10ebbfd59a535c8d22f4ede6e8389622ce98dc0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b57fbc88715b6d18f379463f48a15b560b087ffe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c5c37a821bd1708f26a9522b4a6f47b9f7a20003\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e9e601b7df58ba0c667baf30263331df2c02ffe1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:11:26+00:00",
      "cve": "CVE-2025-68818",
      "id": "CVE-2025-68818",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\"",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68818.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.