CVE-2025-68745

scsi: qla2xxx: Clear cmds after chip reset

State: Published
Severity: 9.8 Critical
Published: Dec 24, 2025
Updated: Oct 30, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Clear cmds after chip reset

Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems:

1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore.

2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs().

So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	aefed3e5548f28e5fecafda6604fcbc65484dbaa to before e87e9f92d7735895b7dd97f53dce6d95d08cf29cAffected aefed3e5548f28e5fecafda6604fcbc65484dbaa to before 0d0a1a267c1ee7c41aeffdca84afcb113787a91aAffected aefed3e5548f28e5fecafda6604fcbc65484dbaa to before c82c0fbb97d0fd44324eb55ab758408c7c964b32Affected aefed3e5548f28e5fecafda6604fcbc65484dbaa to before 5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936Affected aefed3e5548f28e5fecafda6604fcbc65484dbaa to before d46c69a087aa3d1513f7a78f871b80251ea0c1aeAffected eb67b7a23d357f578578e737cb6412ae2384f352Affected ec9639d92c1e10d4bc667e842753d85e21683d5cAffected e6e957f552d5b696879a31e5b0e2a9120e1ea86eAffected 4.9.316 to before 4.10Affected 4.14.281 to before 4.15Affected 4.19.245 to before 4.20Affected
LinuxLinux	5.2Affected before 5.2Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.2 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

aefed3e5548f28e5fecafda6604fcbc65484dbaa to before e87e9f92d7735895b7dd97f53dce6d95d08cf29cAffected
aefed3e5548f28e5fecafda6604fcbc65484dbaa to before 0d0a1a267c1ee7c41aeffdca84afcb113787a91aAffected
aefed3e5548f28e5fecafda6604fcbc65484dbaa to before c82c0fbb97d0fd44324eb55ab758408c7c964b32Affected
aefed3e5548f28e5fecafda6604fcbc65484dbaa to before 5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936Affected
aefed3e5548f28e5fecafda6604fcbc65484dbaa to before d46c69a087aa3d1513f7a78f871b80251ea0c1aeAffected
eb67b7a23d357f578578e737cb6412ae2384f352Affected
ec9639d92c1e10d4bc667e842753d85e21683d5cAffected
e6e957f552d5b696879a31e5b0e2a9120e1ea86eAffected
4.9.316 to before 4.10Affected
4.14.281 to before 4.15Affected
4.19.245 to before 4.20Affected

LinuxLinux

5.2Affected
before 5.2Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.2 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.