What’s Vulnerable › Vulnerabilities

CVE-2025-68782: scsi: target: Reset t_task_cdb pointer in error case

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-13 · updated 2026-10-19
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Reset t_task_cdb pointer in error case If allocation of cmd->t_task_cdb fails, it remains NULL but is later dereferenced in the 'err' path. In case of error, reset NULL t_task_cdb value to point at the default fixed-size buffer. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected products

• Linux kernel: 5.8 — fixed in 6.19

How to fix

Upgrade to a fixed version: Linux kernel 6.19. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0260ad551b0815eb788d47f32899fbcd65d6f128
• https://git.kernel.org/stable/c/0d36db68fdb8a3325386fd9523b67735f944e1f3
• https://git.kernel.org/stable/c/45fd86b444105c8bd07a763f58635c87e5dc7aea
• https://git.kernel.org/stable/c/5053eab38a4c4543522d0c320c639c56a8b59908
• https://git.kernel.org/stable/c/6cac97b12bdab04832e0416d049efcd0d48d303b
• https://git.kernel.org/stable/c/8727663ded659aad55eef21e3864ebf5a4796a96
• https://git.kernel.org/stable/c/8edbb9e371af186b4cf40819dab65fafe109df4d
• https://cert-portal.siemens.com/productcert/html/ssa-019113.html
• https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Get alerted when CVE-2025-68782 or the next vulnerability affects your stack