CVE-2025-68229

Vulnerability

Details

In the Linux kernel's tcm_loop driver, a null pointer dereference vulnerability exists in the tcm_loop_tpg_address_show() function. If the allocation of tl_hba->sh fails during tcm_loop_driver_probe(), the pointer remains NULL. Subsequently, when tcm_loop_tpg_address_show() attempts to dereference this pointer, it triggers a kernel NULL pointer dereference, leading to a system crash [1][2][3].

Exploitation

An attacker with access to the configfs filesystem can trigger this vulnerability by reading the tpg_address attribute for a tcm_loop target port group. The attack requires local access to the system but does not require elevated privileges, as configfs attributes are often readable by unprivileged users. The crash occurs immediately upon reading the attribute when the underlying scsi_host allocation has previously failed [1][2][3].

Impact

Successful exploitation results in a kernel NULL pointer dereference, causing a denial-of-service (DoS) condition via system crash. This can be used by an unprivileged attacker to disrupt system availability. The vulnerability is rated with a CVSS score indicating medium severity due to the need for local access and the resulting crash [1][2][3].

Mitigation

The fix for this vulnerability has been implemented in the Linux kernel mainline and backported to stable releases. The patch adds a NULL check for tl_hba->sh before dereferencing it in tcm_loop_tpg_address_show(). Users should update their kernel to a version that includes this fix, such as those containing commits [1], [2], or [3]. No workarounds are available beyond restricting access to configfs or applying the patch [1][2][3].