CVE-2025-68371

Vulnerability

A race condition exists in the Linux kernel's smartpqi SCSI driver where a scheduled work item to reset a LUN can execute after the device has already been removed. This occurs because the root cause is that the abort handler may schedule a LUN reset concurrently with sdev_destroy(), leading to use-after-free and improper access to freed resources [1].

Exploitation

An attacker with local access and the ability to trigger device removal (e.g., via hot-unplug or driver unbind) while a LUN reset is pending could exploit this race. No special privileges beyond those needed to manage SCSI devices are required, but the attack window is narrow and depends on timing [1].

Impact

Successful exploitation results in use-after-free of device structures, which can lead to system memory corruption, denial of service (kernel panic), or potentially arbitrary code execution in kernel context [1].

Mitigation

The fix introduces three safeguards: checking device presence in the controller's SCSI device list before running a reset, canceling pending TMF work in sdev_destroy(), and holding the LUN reset mutex during device freeing to serialize with ongoing resets [1]. The patch has been applied to the stable kernel tree.