[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-DEBIAN-CVE-2025-68818":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T03:17:55.401Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":25,"related":26,"reserved_at":9,"published_at":27,"modified_at":28,"state":9,"summary":29,"references_raw":31,"kevs":38,"epss":9,"epss_history":39,"metrics":40,"affected":41},"DEBIAN-CVE-2025-68818","In the Linux kernel, the following vulnerability has been resolved:  scsi: Revert \"scsi: qla2xxx: Perform lockless command completion in abort path\"  This reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.  The commit being reverted added code to __qla2x00_abort_all_cmds() to call sp->done() without holding a spinlock.  But unlike the older code below it, this new code failed to check sp->cmd_type and just assumed TYPE_SRB, which results in a jump to an invalid pointer in target-mode with TYPE_TGT_CMD:  qla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success   0000000009f7a79b qla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h   mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h. qla2xxx [0000:65:00.0]-d01e:8: -> fwdump no buffer qla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event   0x8002 occurred qla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -   ha=0000000058183fda. BUG: kernel NULL pointer dereference, address: 0000000000000000 PF: supervisor instruction fetch in kernel mode PF: error_code(0x0010) - not-present page PGD 0 P4D 0 Oops: 0010 [#1] SMP CPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G           O       6.1.133 #1 Hardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206 RAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000 RDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0 RBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045 R10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40 R13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400 FS:  0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  \u003CTASK>  ? __die+0x4d/0x8b  ? page_fault_oops+0x91/0x180  ? trace_buffer_unlock_commit_regs+0x38/0x1a0  ? exc_page_fault+0x391/0x5e0  ? asm_exc_page_fault+0x22/0x30  __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst]  qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst]  qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst]  qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst]  qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst]  kthread+0xa8/0xd0  \u003C/TASK>  Then commit 4475afa2646d (\"scsi: qla2xxx: Complete command early within lock\") added the spinlock back, because not having the lock caused a race and a crash.  But qla2x00_abort_srb() in the switch below already checks for qla2x00_chip_is_down() and handles it the same way, so the code above the switch is now redundant and still buggy in target-mode. Remove it.",null,[],[],[],[14],{"_key":15},"CVE-2025-68818",[17,19,21,23],{"_key":18},"DLA-4476-1",{"_key":20},"DLA-4475-1",{"_key":22},"DSA-6126-1",{"_key":24},"DSA-6127-1",[],[],"2026-01-13T16:16:04.097Z","2026-06-15T18:48:18.352343876Z",{"cisa_kev":30,"cisa_ransomware":30,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[32],{"url":33,"sources":34,"tags":36},"https://security-tracker.debian.org/tracker/CVE-2025-68818",[35],"osv_debian",[37],"Advisory",[],[],[],[42,67],{"ecosystem":43,"name":44,"vendor":45,"product":44,"cpe_part":9,"purl_type":46,"purl_namespace":45,"purl_name":44,"source":9,"versions":47},"Debian","linux","debian","deb",[48,52,53,54,58,61,64],{"version":49,"is_range":50,"range_type":51,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":49,"is_range":50,"range_type":51,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":49,"is_range":50,"range_type":51,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":55,"is_range":50,"range_type":51,"version_start":9,"version_start_type":9,"version_end":56,"version_end_type":57,"fixed_in":9},"lt5_10_249_1","5.10.249-1","excluding",{"version":59,"is_range":50,"range_type":51,"version_start":9,"version_start_type":9,"version_end":60,"version_end_type":57,"fixed_in":9},"lt6_1_162_1","6.1.162-1",{"version":62,"is_range":50,"range_type":51,"version_start":9,"version_start_type":9,"version_end":63,"version_end_type":57,"fixed_in":9},"lt6_12_69_1","6.12.69-1",{"version":65,"is_range":50,"range_type":51,"version_start":9,"version_start_type":9,"version_end":66,"version_end_type":57,"fixed_in":9},"lt6_18_3_1","6.18.3-1",{"ecosystem":43,"name":68,"vendor":45,"product":68,"cpe_part":9,"purl_type":46,"purl_namespace":45,"purl_name":68,"source":9,"versions":69},"linux-6.1",[70,71],{"version":49,"is_range":50,"range_type":51,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":72,"is_range":50,"range_type":51,"version_start":9,"version_start_type":9,"version_end":73,"version_end_type":57,"fixed_in":9},"lt6_1_162_1~deb11u1","6.1.162-1~deb11u1"]