Cloudanix VulnDB

CVE-2025-68229

None

CVSS

—

EPSS

0.2%

Published

Dec 16, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's storage driver can make the whole system crash when certain internal memory allocation fails.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in tcm_loop_tpg_address_show() when tl_hba->sh allocation fails in tcm_loop_driver_probe(), resulting in kernel oops on read access to a non-present page.

Why it matters to the business

Affected Linux kernel deployments may suffer unexpected system crashes or reboots when the tcm_loop module encounters allocation failures, leading to temporary loss of storage target functionality and service disruption.

How an attack unfolds

An attacker with local access or the ability to influence module loading triggers the allocation failure path in tcm_loop_driver_probe(), then invokes the configfs show handler to dereference the uninitialized pointer and induce a kernel panic.

How to fix it

Apply the upstream fix in commit 63f511d3855f7f4b35dd63dbc58fc3d935a81268 or upgrade to a patched kernel version that adds the required NULL check before dereferencing tl_hba->sh; reboot after installation.

How to confirm the fix worked

Confirm the NULL check is present in tcm_loop_tpg_address_show(), reproduce the allocation-failure path in a test environment, and verify absence of the oops signature in kernel logs.

Typical attack path

  1. Cause tl_hba->sh allocation to fail inside tcm_loop_driver_probe()
  2. Trigger tcm_loop_tpg_address_show() via configfs read operation
  3. Dereference NULL pointer leading to kernel NULL pointer dereference oops
  4. Result in system crash or reboot

How to detect it

Search kernel logs and dmesg for strings indicating allocation failure followed by NULL pointer dereference in tcm_loop_tpg_address_show or configfs_read_iter; correlate with process names invoking configfs reads.

  • Unable to allocate struct scsi_host
  • BUG: kernel NULL pointer dereference
  • tcm_loop_tpg_address_show
  • configfs_read_iter

What your security team should do

  • Prioritize kernel updates on all systems exposing tcm_loop or configfs interfaces
  • Review kernel logs for prior occurrences of the described NULL dereference oops
  • Disable tcm_loop module if not required until patches are deployed
  • Monitor EPSS and exploit maturity indicators for any future increase

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_show() we will get a segfault, see below for an example. So, check tl_hba->sh before dereferencing it. Unable to allocate struct scsi_host BUG: kernel NULL pointer dereference, address: 0000000000000194 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024 RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop] ... Call Trace: <TASK> configfs_read_iter+0x12d/0x1d0 [configfs] vfs_read+0x1b5/0x300 ksys_read+0x6f/0xf0 ...

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.5.0 5.4.302
Mageia:9 kernel 0 6.6.120-1.mga9
Mageia:9 kernel-linus 0 6.6.120-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.14-14.mga9
Mageia:9 kmod-xtables-addons 0 3.24-88.mga9

Related vulnerabilities