External risk intelligence

Linux Kernel qla2xxx Driver Command Handling Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

This vulnerability affects a specific SCSI driver (qla2xxx) within the Linux kernel, which manages interaction with physical hardware storage adapters (HBA). It is not a network-facing service, API, or application, and its execution occurs deep within the kernel stack during hardware-level driver operations, making it unreachable from the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability relates to the Linux kernel's SCSI driver, specifically how it handles commands after a chip reset. The issue could lead to commands getting stuck and never being freed, or potentially system instability due to race conditions during command processing. The main concern at this level is confirming if this specific driver is in use and exposed within our environment.

Commands could get stuck after a hardware reset.
Leadership should remember this impacts critical storage management.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by triggering a chip reset in the SCSI driver, causing commands to become stuck and preventing their release. This could lead to system instability or denial of service.

Requires chip reset to trigger.
Stuck commands indicate a potential issue.
Risk of system instability or denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's SCSI driver could affect the proper functioning of storage commands after a chip reset. When commands are sent to the firmware following a reset, they may become stuck and unrecoverable, potentially leading to system instability.

Storage command integrity.
Commands stuck after chip reset.
System instability or data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the Linux kernel's SCSI driver, specifically impacting the qla2xxx module. Ownership likely falls to infrastructure or platform teams managing the underlying host systems where this driver is active. The immediate practical step is to identify systems running this driver, assess their exposure, and confirm the accountable owner for remediation planning.

Infrastructure/Platform teams own.
Verify systems with qla2xxx driver.
Plan remediation by assessing risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the qla2xxx driver in the Linux kernel?

The qla2xxx driver is a component of the Linux kernel responsible for managing QLogic Fibre Channel Host Bus Adapters (HBAs). These adapters allow servers to communicate with high-speed storage area networks. Because this driver operates at a low level, it is essential for the system to reliably send and receive storage commands between the host operating system and physical storage hardware.

How does CVE-2025-68745 impact command processing?

This vulnerability involves a logic flaw in how the driver cleans up tasks after a hardware reset. When a chip reset occurs, some commands sent to the storage firmware can become orphaned, meaning they are never cleared and continue to occupy system resources. Additionally, the driver can experience race conditions where multiple processor cores attempt to perform cleanup operations simultaneously, potentially leading to system instability.

Do I need to worry about network-based attacks for this bug?

No. Triggering this issue requires actions that occur deep within the kernel stack during specific hardware-level driver operations. It is not caused by standard network traffic or remote requests. Simply sending packets to a server will not trigger the bug; the condition relies on the driver's internal state following a hardware or chip-level reset.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal labels this as very unlikely to be reachable from the public internet. Because the vulnerability exists within a specific storage driver rather than a network-facing service or web application, it lacks an obvious external attack surface. The risk is primarily internal, affecting the stability of the storage stack on systems actively using this specific hardware.

What are the first steps to address CVE-2025-68745?

Your initial priority is to identify which servers in your environment are actively using the qla2xxx driver. Once identified, consult your infrastructure or platform team to determine if these systems are running a vulnerable kernel version. Focus on storage-heavy environments where this hardware is present and plan for standard maintenance updates as they become available for your specific Linux distribution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.