CVE-2025-68818: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68818 is a NULL pointer dereference vulnerability in the Linux kernel's SCSI qla2xxx driver, specifically within the __qla2x00_abort_all_cmds() function. It was introduced by a prior commit that added lockless command completion in the abort path without properly checking the sp->cmd_type field, causing a kernel panic when TYPE_TGT_CMD commands are encountered in target-mode. The vulnerability was published on January 13, 2026, and affects the Linux kernel broadly, with confirmed impact on Microsoft Azure Linux 3 kernel version 6.6.119.3-3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is a NULL pointer dereference (CWE-476) introduced by commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9, which added code in __qla2x00_abort_all_cmds() to call sp->done() without holding a spinlock and without validating sp->cmd_type. When the driver operates in target-mode and encounters a TYPE_TGT_CMD command type (rather than the assumed TYPE_SRB), execution jumps to an invalid (NULL) pointer, triggering a supervisor instruction fetch fault and kernel oops. The fix reverts the offending commit to restore the original spinlock-protected, type-checked code path. Kernel crash logs show RIP: 0010:0x0 and a page fault with error code 0x0010 (not-present page, instruction fetch) (Red Hat CVE).

Successful exploitation results in a kernel NULL pointer dereference that crashes the system, causing a complete denial of service. An attacker with local, low-privileged access on a system using qla2xxx SCSI adapters in target-mode configuration can trigger this crash, making the system unavailable. There is no confidentiality or integrity impact; the sole consequence is loss of availability (Red Hat CVE, Microsoft MSRC).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: 0010:0x0 and PF: supervisor instruction fetch in kernel mode.
• Logs: qla2xxx driver messages such as ISP System Error, qla_target(0): System error async event 0x8002 occurred, and Performing ISP error recovery immediately preceding the crash.
• Logs: Kernel oops trace referencing qla2xxx_<N>_dpc process and __qla2x00_abort_all_cmds in the call stack.
• System: Unexpected system reboots or kernel panics on hosts equipped with QLogic qla2xxx Fibre Channel HBAs operating in target mode.

The fix involves reverting commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9 in the Linux kernel, which has been applied across multiple stable kernel branches (patches available at git.kernel.org stable trees). Microsoft has released a security update for Azure Linux 3 kernel version 6.6.119.3-3. Downstream distributions including Debian (linux 6.1.162-1), Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113), openSUSE, and SUSE have also issued updates. Administrators should apply the relevant kernel update for their distribution immediately; as a temporary workaround, restricting local user access and avoiding qla2xxx target-mode configurations on unpatched systems can reduce risk (Red Hat CVE, Microsoft MSRC).