CVE-2025-68782: scsi: target: Reset t_task_cdb pointer in error case
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: Reset ttaskcdb pointer in error case
If allocation of cmd->ttaskcdb fails, it remains NULL but is later dereferenced in the 'err' path.
In case of error, reset NULL ttaskcdb value to point at the default fixed-size buffer.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68782?
CVE-2025-68782 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-68782?
To fix CVE-2025-68782, upgrade to the latest stable version of the Linux kernel where this vulnerability has been patched.
What is the impact of CVE-2025-68782?
The impact of CVE-2025-68782 includes potential dereferencing of a NULL pointer, which could lead to system instability or crashes.
Which versions of the Linux kernel are affected by CVE-2025-68782?
CVE-2025-68782 affects certain versions of the Linux kernel where the t_task_cdb pointer is improperly managed.
Who should be concerned about CVE-2025-68782?
System administrators using vulnerable versions of the Linux kernel should be concerned about CVE-2025-68782 and take action to mitigate it.