CVE-2025-68782: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68782 is a null pointer dereference vulnerability in the Linux kernel's SCSI target subsystem. It was discovered by the Linux Verification Center (linuxtesting.org) using the SVACE static analysis tool and published on January 13, 2026. The flaw affects Linux kernel versions from 5.8 up to (but not including) the patched releases: 6.1.160, 6.6.120, 6.12.64, 6.18.3, and 6.19-rc1. It carries a CVSS v3.1 base score of 8.6 (High) as assessed by Microsoft (Feedly, Microsoft MSRC).

The root cause is a null pointer dereference (CWE-476) in the SCSI target subsystem (drivers/target/). When memory allocation for cmd->t_task_cdb fails during command processing, the pointer remains NULL. The error handling (err) path subsequently dereferences this NULL pointer without first resetting it to point to the default fixed-size buffer (cmd->__t_task_cdb), leading to a kernel crash or undefined behavior. The attack vector is network-based (AV:N), requires no privileges (PR:N), and no user interaction (UI:N), meaning a remote attacker can send specially crafted SCSI commands to a vulnerable target to trigger the allocation failure and subsequent dereference (Feedly, Microsoft MSRC).

Successful exploitation can cause a denial of service via kernel crash or hang on systems with SCSI target functionality enabled. Additionally, the null pointer dereference may result in limited information disclosure through memory access violations, and could compromise the integrity of the SCSI target subsystem. Systems acting as iSCSI or other SCSI targets are at the highest risk of unexpected service interruptions (Feedly).

Update the Linux kernel to one of the following patched versions: 6.1.160, 6.6.120, 6.12.64, 6.18.3, or 6.19-rc1 or later. Downstream distributions including Debian (DSA-6126-1, DLA-4475-1), Ubuntu (USN-8177-1/2, USN-8179-1/2/3/4, USN-8183-1/2, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), Amazon Linux 2, and Oracle Linux 9 have released updated kernel packages. Microsoft has also released an update for azl3_kernel_6.6.119.3-3. As a temporary workaround where patching is not immediately possible, restrict network access to SCSI target services and monitor system logs for null pointer dereference errors or unexpected kernel crashes related to SCSI operations (Feedly, Microsoft MSRC, Debian LTS).