CVE-2025-68741
A critical flaw in the Linux kernel’s SCSI driver can corrupt memory when freeing certain items. The bug occurs in the qla2xxx driver when it incorrectly frees pre‑allocated memory, potentially leading to system crashes or arbitrary code execution. The issue has been fixed in a kernel update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, specifically the qla2xxx SCSI driver used in systems with QLogic QLA2xxx adapters. Users running affected kernel versions that include the qla2xxx driver are at risk.
Real-world impact
An attacker could exploit the memory corruption to crash the system or execute arbitrary code, potentially taking control of the affected machine.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the system.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2025-68741.
NVD description indicates the vulnerability has been resolved.
Timeline
- Dec 24, 2025 · Dec 24, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.