LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal

In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues. This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdev_destroy(), leading to use-after-free and improper access to freed resources. - Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped. - Cancel any pending TMF work that has not started in sdev_destroy(). - Ensure device freeing in sdev_destroy() is done while holding the LUN reset mutex to avoid races with ongoing resets.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-68371 is a Linux kernel race condition in the smartpqi SCSI driver. During device removal, delayed reset work could still touch resources that had already been freed. The likely business impact is instability or crash risk on affected systems using this storage path, but the provided sources do not give CVSS, confirmed exploitation, or a complete product impact list.

Executive priority

Treat this as a targeted kernel maintenance issue rather than an internet-wide emergency based on current evidence. Prioritize storage-heavy Linux servers and vendor appliances, especially where uptime matters and kernel updates are already due.

Technical view

The flaw is a use-after-free/resource access race in smartpqi LUN reset handling. An abort handler could schedule reset work while sdev_destroy() removes the device. The fix checks whether the SCSI device remains present, cancels pending TMF work during destruction, and protects freeing with the LUN reset mutex.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the smartpqi driver in use. The source bundle lists Linux kernel versions and stable kernel commits but does not provide distribution-specific package names or a complete downstream product matrix.

Exploitation context

The CVE is not listed as KEV in the supplied data. The sources describe a race during device removal and reset handling, but do not state public exploitation, exploit availability, or remote attack conditions.

Researcher notes

The source bundle supports a race/use-after-free conclusion but lacks CVSS, CWE, exploitability detail, and distribution package mapping. Analysis should stay anchored to smartpqi device removal and reset concurrency until vendor advisories add clearer scope.

Mitigation direction

  • Apply supported Linux kernel or distribution updates that include the referenced stable fixes.
  • Check vendor guidance for appliances or products embedding Linux, including the Siemens advisory.
  • Prioritize systems where the smartpqi driver is loaded and storage devices are actively managed.
  • Use normal change controls for kernel updates on storage-dependent production systems.

Validation and detection

  • Inventory Linux hosts for affected kernel versions and smartpqi driver usage.
  • Confirm updated kernels include one of the referenced stable fix commits or a vendor backport.
  • Review vendor advisories for downstream product-specific affected versions and fixed releases.
  • Monitor storage and kernel logs for device removal, reset, or smartpqi-related instability.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68371 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2d80f4054f7f901b8ad97358a9069616ac8524c7, 2d80f4054f7f901b8ad97358a9069616ac8524c7, 2d80f4054f7f901b8ad97358a9069616ac8524c7, 2d80f4054f7f901b8ad97358a9069616ac8524c7, 2d80f4054f7f901b8ad97358a9069616ac8524c7, 2d80f4054f7f901b8ad97358a9069616ac8524c7unaffected
LinuxLinux6.0, 0, 6.1.160, 6.6.120, 6.12.63, 6.17.13, 6.18.2, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.