Answer in brief
CVE-2025-68745 records a Critical severity (CVSS 9.8) vulnerability in scsi: qla2xxx: Clear cmds after chip reset. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=aefed3e5548f28e5fecafda6604fcbc65484dbaa <5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936 || >=aefed3e5548f28e5fecafda6604fcbc65484dbaa <d46c69a087aa3d1513f7a78f871b80251ea0c1ae || eb67b7a23d357f578578e737cb6412ae2384f352 || ec9639d92c1e10d4bc667e842753d85e21683d5c || e6e957f552d5b696879a31e5b0e2a9120e1ea86e || >=4.9.316 <4.10 || >=4.14.281 <4.15 || >=4.19.245 <4.20 | 5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936, d46c69a087aa3d1513f7a78f871b80251ea0c1ae, 4.10, 4.15, 4.20 |
| Linux/Linuxgeneric | 5.2 | Not reported |
Published upstream
Dec 24, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems: 1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore. 2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs(). So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds.
Quoted source text, attributed separately from HOL analysis.