CVE-2025-68371: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68371 is a use-after-free race condition vulnerability in the Linux kernel's scsi: smartpqi driver, caused by device resources being accessed after device removal. A scheduled LUN reset work item could execute after the associated SCSI device was removed via sdev_destroy(), leading to use-after-free and improper access to freed resources. The vulnerability was disclosed on December 24, 2025, and affects Linux kernel versions starting from commit 2d80f4054f7f901b8ad97358a9069616ac8524c7 up to the patched commits across multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-416: Use After Free) in the smartpqi SCSI driver. The abort handler can schedule a LUN reset work item concurrently with device removal via sdev_destroy(), and if the work item executes after the device structure has been freed, it accesses invalid memory. The fix addresses this through three mechanisms: checking whether the device is still present in the controller's SCSI device list before executing a reset, canceling any pending TMF (Task Management Function) work items in sdev_destroy() before they start, and ensuring device freeing in sdev_destroy() is performed while holding the LUN reset mutex to prevent races with ongoing resets. Exploitation requires local access with low privileges (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation of this vulnerability can cause a kernel crash or system instability, resulting in a denial of service (high availability impact). There is no confidentiality or integrity impact identified, as the vulnerability is limited to improper memory access in the kernel's SCSI subsystem during device removal. The scope is confined to the local system running an affected Linux kernel with the smartpqi driver active (Red Hat Advisory).

Patches have been applied to multiple Linux kernel stable branches. Fixed commits include eccc02ba1747501d92bb2049e3ce378ba372f641 (6.12.x), 4e1acf1b6dd6dd0495bda139daafd7a403ae2dc1 (6.17.x), 1a5c5a2f88e839af5320216a02ffb075b668596a (6.18.x), and b518e86d1a70a88f6592a7c396cf1b93493d1aab (6.19-rc1). Patched versions include Linux 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. Downstream distributions including Debian (6.1.162-1), Ubuntu (USN-8179-x, USN-8184-1, USN-8185-x, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), and Oracle Linux have released updated kernel packages. Administrators should update to the latest patched kernel version for their distribution as soon as possible (Red Hat Bugzilla, Debian LTS, Ubuntu USN-8179-1).