CVE-2025-68741: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68741 is a memory corruption vulnerability in the Linux kernel's qla2xxx SCSI driver caused by improper freeing of a purex item. In qla2xxx_process_purls_iocb(), an error handling path incorrectly calls kfree() on an item that may have been allocated from a per-adapter pre-allocated pool rather than via kzalloc(), leading to kernel memory corruption. The vulnerability affects Linux kernel versions from commit 875386b98857822b77ac7f95bdf367b70af5b78c onward, including Azure Linux 3 kernel versions 6.6.117.1-1 and 6.6.119.3-3. It was published on December 24, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC, Feedly).

The root cause is classified as improper memory management (CWE-762: Mismatched Memory Management Routines). The qla24xx_alloc_purex_item() function may return either a dynamically allocated item (via kzalloc()) or a pre-allocated item from a per-adapter pool, depending on the allocation size. When an error occurs in qla2xxx_process_purls_iocb(), the code unconditionally calls kfree() on the returned item; if the item originated from the pre-allocated pool, this is an invalid operation that corrupts kernel memory. The fix replaces the incorrect kfree() call with qla24xx_free_purex_item(), which correctly handles both allocation types. Exploitation requires local access and low privileges, triggered by malformed SCSI requests that cause the error handling path to execute (Feedly).

Successful exploitation can cause kernel memory corruption, leading to system crashes, denial of service, or unpredictable kernel behavior. The primary impact is on system availability (high), with no direct confidentiality or integrity impact. Affected systems include those running vulnerable Linux kernel versions with QLogic Fibre Channel HBAs (qla2xxx driver), including Azure Linux 3 deployments (Feedly, Microsoft MSRC).

• Logs: Unexpected kernel oops or panic messages in /var/log/kern.log or dmesg output referencing qla2xxx_process_purls_iocb() or related qla2xxx driver functions.
• Process/System Behavior: Sudden system crashes or kernel panics on hosts with QLogic Fibre Channel HBAs; unexpected reboots on systems running affected kernel versions.
• File System: Kernel crash dump files (e.g., /var/crash/) generated around the time of anomalous SCSI activity.

Apply the available kernel patches that replace the incorrect kfree() call with qla24xx_free_purex_item(). Fixed versions include Linux kernel 6.19-rc1, 6.18.2, 6.17.13, and 6.12.63, with stable branch commits available. Downstream distributions including Red Hat (RHSA-2026:8921, RHSA-2026:9131, RHSA-2026:9264, and others), Ubuntu (USN-8179-1/2/3/4, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), AlmaLinux, Rocky Linux, and Oracle Linux have released updated kernel packages. As a temporary workaround where patching is not immediately possible, restrict local access to affected systems and consider disabling or limiting access to Fibre Channel SCSI devices (Feedly, Microsoft MSRC).