Red Hat has issued an important security advisory for the Linux kernel packages addressing multiple vulnerabilities including denial of service, missing permission checks, out-of-bounds reads, use-after-free, and improper handling of cryptographic requests. These vulnerabilities affect core kernel components such as the SCSI driver, rtnetlink, crypto subsystems, procfs, mac802154, nvmet, selinux, and others. The advisory recommends updating the kernel packages and rebooting the system to apply the fixes.

Red Hat Security Advisory: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)

* kernel: procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199)

* kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

* kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)

* kernel: netfs: Fix early put of sink folio in netfs_read_gaps() (CVE-2026-64061)

* kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

* kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)

* kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

* kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

* kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)

* kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)

* kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

* kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

* kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)

* kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)

* kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

* kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This Red Hat Security Advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 9. The update includes fixes for a denial of service vulnerability in the qla2xxx SCSI driver (CVE-2025-68745) and numerous other security issues affecting components such as DRM, Bluetooth, SCTP, Wi-Fi subsystems, and more. The advisory also includes bug fixes and enhancements unrelated to security. Red Hat recommends applying this update promptly and rebooting the system to ensure the fixes take effect.

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

This Red Hat security advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 8. The issues include a denial of service vulnerability in the qla2xxx SCSI driver, several memory safety and validation flaws in SCTP, netfilter, and other kernel subsystems, as well as use-after-free and race condition bugs. These vulnerabilities could impact system stability and security. The update includes fixes and enhancements to mitigate these issues. Systems must be rebooted after applying the update for changes to take effect.

Red Hat has issued a security advisory for the kernel-rt packages, which provide the Real Time Linux Kernel for systems requiring high determinism. The update addresses multiple security vulnerabilities including a denial of service in the qla2xxx SCSI driver, use-after-free issues, race conditions, and validation errors across various kernel subsystems such as SCSI, SCTP, netfilter, and TIPC. The advisory also includes bug fixes and enhancements. The update is rated as important by Red Hat and requires a system reboot to take effect.

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Clear cmds after chip reset

Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling
and host reset handling") caused two problems:

1. Commands sent to FW, after chip reset got stuck and never freed as FW
   is not going to respond to them anymore.

2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd().  Commit 26f9ce53817a
   ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands")
   attempted to fix this, but introduced another bug under different
   circumstances when two different CPUs were racing to call
   qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in
   dma_unmap_sg_attrs().

So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and
partially revert "scsi: qla2xxx: target: Fix offline port handling and
host reset handling" at __qla2x00_abort_all_cmds.

CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset in Linux kernel

linux-azure

linux-aws-hwe

linux-gcp

linux-hwe

linux-hwe-edge

linux-oracle

linux

linux-aws

linux-aws-5.0

linux-aws-5.3

linux-aws-5.4

linux-azure-4.15

linux-azure-5.3

linux-azure-5.4

linux-azure-edge

linux-gcp-4.15

linux-gcp-5.3

linux-gcp-5.4

linux-gke-4.15

linux-gke-5.4

linux-gkeop-5.4

linux-hwe-5.4

linux-ibm-5.4

linux-kvm

linux-oem

linux-oracle-5.0

linux-oracle-5.3

linux-oracle-5.4

linux-raspi-5.4

linux-aws-fips

linux-azure-fips

linux-fips

linux-gcp-fips

linux-aws-5.11

linux-aws-5.13

linux-aws-5.15

linux-aws-5.8

linux-azure-5.11

linux-azure-5.13

linux-azure-5.15

linux-azure-5.8

linux-azure-fde

linux-azure-fde-5.15

linux-bluefield

linux-gcp-5.11

linux-gcp-5.13

linux-gcp-5.15

linux-gcp-5.8

linux-gke

linux-gke-5.15

linux-gkeop

linux-gkeop-5.15

linux-hwe-5.11

linux-hwe-5.13

linux-hwe-5.15

linux-hwe-5.8

linux-ibm

linux-ibm-5.15

linux-intel-5.13

linux-intel-iotg-5.15

linux-iot

linux-lowlatency-hwe-5.15

linux-nvidia-tegra-5.15

linux-oem-5.10

linux-oem-5.13

linux-oem-5.14

linux-oem-5.6

linux-oracle-5.11

linux-oracle-5.13

linux-oracle-5.15

linux-oracle-5.8

linux-raspi

linux-raspi2

linux-riscv

linux-riscv-5.11

linux-riscv-5.15

linux-riscv-5.8

linux-xilinx-zynqmp

linux-allwinner-5.19

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems: 1. Commands sent to FW, after chip reset got stuck and never freed as FW    is not going to respond to them anymore. 2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd().  Commit 26f9ce53817a    ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands")    attempted to fix this, but introduced another bug under different    circumstances when two different CPUs were racing to call    qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in    dma_unmap_sg_attrs(). So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds.

CVE-2025-68745 is a critical vulnerability in the Linux kernel's qla2xxx SCSI driver related to improper handling of commands after a chip reset. The flaw causes commands sent to firmware after reset to get stuck and never freed, leading to potential system instability or denial of service. Attempts to fix this introduced race conditions causing kernel bugs. The issue has been addressed by reverting problematic commits and applying partial fixes in Linux kernel versions 4.10, 4.15, 4.20, and later.

Search: CVE-2025-68745