CVE-2025-68745
A critical flaw in the Linux kernel’s qla2xxx SCSI driver caused commands to hang after a chip reset and triggered kernel crashes. The issue was fixed by reverting a recent change that mishandled DMA unmapping and by partially reverting another change that mishandled port and host resets. The fix is now included in the kernel source.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, specifically the qla2xxx SCSI driver. Users running kernel versions before the fix that include the problematic commits are affected.
Real-world impact
An attacker could send specially crafted SCSI commands to a target system, causing the kernel to hang or crash, potentially leading to denial of service or privilege escalation.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact (complete confidentiality, integrity, and availability loss) and the fact that it can be exploited remotely without authentication or user interaction.
What to do about it
- 01Update your Linux kernel to a version that includes the fix (commit aefed3e5548f and revert of 26f9ce53817a).
- 02Reboot the system to load the updated kernel.
NVD description
Timeline
- Dec 24, 2025 · Dec 24, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.