CVE-2025-68741

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s scsi subsystem, specifically within the qla2xxx driver. The issue involves improper memory freeing of items allocated for processing I/O control blocks (IOCBs). The qla24xx alloc purex item() function can return a pre-allocated item instead of dynamically allocating memory. Subsequently, the qla2xxx process purls iocb() function incorrectly uses kfree() to release these pre-allocated items, leading to potential memory corruption. The fix involves using the correct deallocation function, qla24xx free purex item(), to handle both dynamically allocated and pre-allocated items correctly.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.