CVE-2025-68745

What it actually does

Race condition in qla2xxx SCSI driver after chip reset allows stuck commands that are never freed and concurrent qlt_unmap_sg calls from multiple CPUs triggering BUG_ON in dma_unmap_sg_attrs or qlt_free_cmd.

Why it matters to the business

Linux servers using QLogic Fibre Channel adapters may suffer kernel crashes or storage command hangs, leading to downtime and loss of availability for storage-dependent workloads; low exploitability and no ransomware association reduce urgency but kernel updates remain necessary.

How an attack unfolds

An attacker with local access triggers a chip reset then races command abort and unmap paths across CPUs to hit the DMA direction or sg_mapped assertion, causing denial of service; no named threat actors or public exploits are known.

How to fix it

Upgrade the Linux kernel to a version containing commit 5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936 which reverts the faulty changes and ensures commands are cleared after chip reset.

How to confirm the fix worked

Confirm the running kernel includes commit 5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936; reproduce chip reset scenarios in a test environment and verify absence of BUG_ON assertions and stuck commands.

Typical attack path

1. Obtain local shell on affected Linux host with qla2xxx driver loaded
2. Force or wait for qla2xxx chip reset condition
3. Induce concurrent qlt_free_cmd and qlt_unmap_sg calls from different CPUs
4. Trigger kernel BUG_ON or leaked commands leading to crash or hang

How to detect it

Search kernel logs and dmesg for BUG_ON messages referencing valid_dma_direction, sg_mapped, qlt_free_cmd, or qla2xxx chip reset handling; correlate with Fibre Channel link events.

What your security team should do

• Apply the referenced kernel commit to all systems using qla2xxx adapters as soon as possible
• Monitor kernel logs for qla2xxx and dma_unmap related BUG_ON entries
• Isolate or disable affected HBAs on high-availability systems until patched