CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal
In the Linux kernel, the following vulnerability has been resolved:
scsi: smartpqi: Fix device resources accessed after device removal
Correct possible race conditions during device removal.
Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues.
This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdevdestroy(), leading to use-after-free and improper access to freed resources.
- Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped.
- Cancel any pending TMF work that has not started in sdevdestroy().
- Ensure device freeing in sdevdestroy() is done while holding the LUN reset mutex to avoid races with ongoing resets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Resolve the race by (1) canceling any pending TMF work that has not started in sdev_destroy(), (2) in the device reset handler, check whether the device is still present in the controller's SCSI device list before running the reset, and (3) ensure device freeing in sdev_destroy() is performed while holding the LUN reset mutex.
Linux kernel (scsi) Fix device resources accessed after device removal (race conditions) = Apply the LUN reset mutex / device-reset handler presence check / hold required lock in sdev_destroy()
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68371?
CVE-2025-68371 is classified as a major vulnerability that can lead to critical unintended consequences if exploited.
How do I fix CVE-2025-68371?
To fix CVE-2025-68371, update to the latest version of the Linux kernel that includes the applied patch.
What systems are affected by CVE-2025-68371?
CVE-2025-68371 affects systems running specific versions of the Linux kernel that utilize the SCSI smartpqi driver.
What are the risks associated with CVE-2025-68371?
The risks associated with CVE-2025-68371 include potential data loss and system instability due to race conditions during device removal.
What should I do if I cannot patch CVE-2025-68371 immediately?
If a patch for CVE-2025-68371 cannot be applied immediately, minimize the use of affected devices and consider temporarily disabling them until a fix is implemented.