{"cve":"CVE-2025-68371","nvd":{"published":"2025-12-24T11:16:00.673","modified":"2026-10-15T02:18:12.303","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: smartpqi: Fix device resources accessed after device removal\n\nCorrect possible race conditions during device removal.\n\nPreviously, a scheduled work item to reset a LUN could still execute\nafter the device was removed, leading to use-after-free and other\nresource access issues.\n\nThis race condition occurs because the abort handler may schedule a LUN\nreset concurrently with device removal via sdev_destroy(), leading to\nuse-after-free and improper access to freed resources.\n\n  - Check in the device reset handler if the device is still present in\n    the controller's SCSI device list before running; if not, the reset\n    is skipped.\n\n  - Cancel any pending TMF work that has not started in sdev_destroy().\n\n  - Ensure device freeing in sdev_destroy() is done while holding the\n    LUN reset mutex to avoid races with ongoing resets.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/1a5c5a2f88e839af5320216a02ffb075b668596a","https://git.kernel.org/stable/c/4e1acf1b6dd6dd0495bda139daafd7a403ae2dc1","https://git.kernel.org/stable/c/6d2390653d82cad0e1ba2676e536dd99678f6ef1","https://git.kernel.org/stable/c/7dfa5a5516ec3c6b9b6c22ee18f0eb2df3f38ef2","https://git.kernel.org/stable/c/b518e86d1a70a88f6592a7c396cf1b93493d1aab"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2025-68371","score":0.00198,"percentile":0.09462,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}