GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68782 (GCVE-0-2025-68782)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:28 – Updated: 2026-09-08 08:43
VLAI
Title
scsi: target: Reset t_task_cdb pointer in error case
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Reset t_task_cdb pointer in error case If allocation of cmd->t_task_cdb fails, it remains NULL but is later dereferenced in the 'err' path. In case of error, reset NULL t_task_cdb value to point at the default fixed-size buffer. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 19:10 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9e95fb805dc043cc8ed878a08d1583e4097a5f80 , < 6cac97b12bdab04832e0416d049efcd0d48d303b (git)
Affected: 9e95fb805dc043cc8ed878a08d1583e4097a5f80 , < 45fd86b444105c8bd07a763f58635c87e5dc7aea (git)
Affected: 9e95fb805dc043cc8ed878a08d1583e4097a5f80 , < 8727663ded659aad55eef21e3864ebf5a4796a96 (git)
Affected: 9e95fb805dc043cc8ed878a08d1583e4097a5f80 , < 0260ad551b0815eb788d47f32899fbcd65d6f128 (git)
Affected: 9e95fb805dc043cc8ed878a08d1583e4097a5f80 , < 0d36db68fdb8a3325386fd9523b67735f944e1f3 (git)
Affected: 9e95fb805dc043cc8ed878a08d1583e4097a5f80 , < 8edbb9e371af186b4cf40819dab65fafe109df4d (git)
Affected: 9e95fb805dc043cc8ed878a08d1583e4097a5f80 , < 5053eab38a4c4543522d0c320c639c56a8b59908 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68782",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:10:49.122593Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:10:58.146Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:43:27.480Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6cac97b12bdab04832e0416d049efcd0d48d303b",
              "status": "affected",
              "version": "9e95fb805dc043cc8ed878a08d1583e4097a5f80",
              "versionType": "git"
            },
            {
              "lessThan": "45fd86b444105c8bd07a763f58635c87e5dc7aea",
              "status": "affected",
              "version": "9e95fb805dc043cc8ed878a08d1583e4097a5f80",
              "versionType": "git"
            },
            {
              "lessThan": "8727663ded659aad55eef21e3864ebf5a4796a96",
              "status": "affected",
              "version": "9e95fb805dc043cc8ed878a08d1583e4097a5f80",
              "versionType": "git"
            },
            {
              "lessThan": "0260ad551b0815eb788d47f32899fbcd65d6f128",
              "status": "affected",
              "version": "9e95fb805dc043cc8ed878a08d1583e4097a5f80",
              "versionType": "git"
            },
            {
              "lessThan": "0d36db68fdb8a3325386fd9523b67735f944e1f3",
              "status": "affected",
              "version": "9e95fb805dc043cc8ed878a08d1583e4097a5f80",
              "versionType": "git"
            },
            {
              "lessThan": "8edbb9e371af186b4cf40819dab65fafe109df4d",
              "status": "affected",
              "version": "9e95fb805dc043cc8ed878a08d1583e4097a5f80",
              "versionType": "git"
            },
            {
              "lessThan": "5053eab38a4c4543522d0c320c639c56a8b59908",
              "status": "affected",
              "version": "9e95fb805dc043cc8ed878a08d1583e4097a5f80",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Reset t_task_cdb pointer in error case\n\nIf allocation of cmd-\u003et_task_cdb fails, it remains NULL but is later\ndereferenced in the \u0027err\u0027 path.\n\nIn case of error, reset NULL t_task_cdb value to point at the default\nfixed-size buffer.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote initiator can reach target_cmd_init_cdb() by sending an iSCSI SCSI Command PDU containing a variable-length CDB over TCP, iSER, or supported network offload transports.\nAC:L - The attacker controls the extended-CDB request and can create allocator pressure through concurrent sessions and outstanding commands before repeatedly triggering the allocation. No race or condition outside the attacker\u0027s practical influence is required.\nPR:N - LIO supports AuthMethod=None and dynamic initiator ACLs, allowing a remote attacker to establish a normal iSCSI session without credentials in a reasonable permissive deployment.\nUI:N - Exploitation requires only attacker-generated sessions and SCSI commands, without any victim action.\nS:U - Through the network iSCSI path, the vulnerable target-core code and the affected kernel availability remain within the same host security authority.\nC:N - The failed allocation produces a fixed NULL destination rather than an attacker-controlled read primitive, and no kernel data is disclosed.\nI:N - The attempted copy targets unmapped address zero and faults instead of modifying a live kernel object; it does not provide an arbitrary or useful write primitive.\nA:H - The NULL-destination memcpy can cause a kernel oops or panic, and a remote initiator can repeat the trigger to disrupt the target or entire system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:26.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6cac97b12bdab04832e0416d049efcd0d48d303b"
        },
        {
          "url": "https://git.kernel.org/stable/c/45fd86b444105c8bd07a763f58635c87e5dc7aea"
        },
        {
          "url": "https://git.kernel.org/stable/c/8727663ded659aad55eef21e3864ebf5a4796a96"
        },
        {
          "url": "https://git.kernel.org/stable/c/0260ad551b0815eb788d47f32899fbcd65d6f128"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d36db68fdb8a3325386fd9523b67735f944e1f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8edbb9e371af186b4cf40819dab65fafe109df4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5053eab38a4c4543522d0c320c639c56a8b59908"
        }
      ],
      "title": "scsi: target: Reset t_task_cdb pointer in error case",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68782",
    "datePublished": "2026-01-13T15:28:56.929Z",
    "dateReserved": "2025-12-24T10:30:51.036Z",
    "dateUpdated": "2026-09-08T08:43:27.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68782",
      "date": "2026-09-15",
      "epss": "0.00587",
      "percentile": "0.46325"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68782\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:15:57.890\",\"lastModified\":\"2026-07-30T06:24:43.807\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: target: Reset t_task_cdb pointer in error case\\n\\nIf allocation of cmd-\u003et_task_cdb fails, it remains NULL but is later\\ndereferenced in the \u0027err\u0027 path.\\n\\nIn case of error, reset NULL t_task_cdb value to point at the default\\nfixed-size buffer.\\n\\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nscsi: target: Restablecer el puntero t_task_cdb en caso de error\\n\\nSi la asignaci\u00f3n de cmd-\u0026gt;t_task_cdb falla, permanece NULL pero luego es desreferenciado en la ruta de \u0027error\u0027.\\n\\nEn caso de error, restablecer el valor NULL de t_task_cdb para que apunte al b\u00fafer predeterminado de tama\u00f1o fijo.\\n\\nEncontrado por Linux Verification Center (linuxtesting.org) con SVACE.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/target/target_core_transport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9e95fb805dc043cc8ed878a08d1583e4097a5f80\",\"lessThan\":\"6cac97b12bdab04832e0416d049efcd0d48d303b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e95fb805dc043cc8ed878a08d1583e4097a5f80\",\"lessThan\":\"45fd86b444105c8bd07a763f58635c87e5dc7aea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e95fb805dc043cc8ed878a08d1583e4097a5f80\",\"lessThan\":\"8727663ded659aad55eef21e3864ebf5a4796a96\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e95fb805dc043cc8ed878a08d1583e4097a5f80\",\"lessThan\":\"0260ad551b0815eb788d47f32899fbcd65d6f128\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e95fb805dc043cc8ed878a08d1583e4097a5f80\",\"lessThan\":\"0d36db68fdb8a3325386fd9523b67735f944e1f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e95fb805dc043cc8ed878a08d1583e4097a5f80\",\"lessThan\":\"8edbb9e371af186b4cf40819dab65fafe109df4d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e95fb805dc043cc8ed878a08d1583e4097a5f80\",\"lessThan\":\"5053eab38a4c4543522d0c320c639c56a8b59908\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/target/target_core_transport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.160\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.120\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-16T19:10:49.122593Z\",\"id\":\"CVE-2025-68782\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0260ad551b0815eb788d47f32899fbcd65d6f128\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0d36db68fdb8a3325386fd9523b67735f944e1f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/45fd86b444105c8bd07a763f58635c87e5dc7aea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5053eab38a4c4543522d0c320c639c56a8b59908\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6cac97b12bdab04832e0416d049efcd0d48d303b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8727663ded659aad55eef21e3864ebf5a4796a96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8edbb9e371af186b4cf40819dab65fafe109df4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-21T20:46:51+00:00",
      "cve": "CVE-2025-68782",
      "id": "CVE-2025-68782",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: target: Reset t_task_cdb pointer in error case",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68782.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T01:41:42Z",
      "cve": "CVE-2025-68782",
      "id": "CVE-2025-68782",
      "initial_release_date": "2026-01-15T00:26:28Z",
      "product_status:known_affected": "455",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68782",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68782.json",
      "version": "13"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-07-14T12:44:14.521Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-68782\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T19:10:49.122593Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T19:10:53.900Z\"}}], \"cna\": {\"title\": \"scsi: target: Reset t_task_cdb pointer in error case\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - A remote initiator can reach target_cmd_init_cdb() by sending an iSCSI SCSI Command PDU containing a variable-length CDB over TCP, iSER, or supported network offload transports.\\nAC:L - The attacker controls the extended-CDB request and can create allocator pressure through concurrent sessions and outstanding commands before repeatedly triggering the allocation. No race or condition outside the attacker\u0027s practical influence is required.\\nPR:N - LIO supports AuthMethod=None and dynamic initiator ACLs, allowing a remote attacker to establish a normal iSCSI session without credentials in a reasonable permissive deployment.\\nUI:N - Exploitation requires only attacker-generated sessions and SCSI commands, without any victim action.\\nS:U - Through the network iSCSI path, the vulnerable target-core code and the affected kernel availability remain within the same host security authority.\\nC:N - The failed allocation produces a fixed NULL destination rather than an attacker-controlled read primitive, and no kernel data is disclosed.\\nI:N - The attempted copy targets unmapped address zero and faults instead of modifying a live kernel object; it does not provide an arbitrary or useful write primitive.\\nA:H - The NULL-destination memcpy can cause a kernel oops or panic, and a remote initiator can repeat the trigger to disrupt the target or entire system.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9e95fb805dc043cc8ed878a08d1583e4097a5f80\", \"lessThan\": \"6cac97b12bdab04832e0416d049efcd0d48d303b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e95fb805dc043cc8ed878a08d1583e4097a5f80\", \"lessThan\": \"45fd86b444105c8bd07a763f58635c87e5dc7aea\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e95fb805dc043cc8ed878a08d1583e4097a5f80\", \"lessThan\": \"8727663ded659aad55eef21e3864ebf5a4796a96\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e95fb805dc043cc8ed878a08d1583e4097a5f80\", \"lessThan\": \"0260ad551b0815eb788d47f32899fbcd65d6f128\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e95fb805dc043cc8ed878a08d1583e4097a5f80\", \"lessThan\": \"0d36db68fdb8a3325386fd9523b67735f944e1f3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e95fb805dc043cc8ed878a08d1583e4097a5f80\", \"lessThan\": \"8edbb9e371af186b4cf40819dab65fafe109df4d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e95fb805dc043cc8ed878a08d1583e4097a5f80\", \"lessThan\": \"5053eab38a4c4543522d0c320c639c56a8b59908\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/target/target_core_transport.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.248\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.198\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/target/target_core_transport.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6cac97b12bdab04832e0416d049efcd0d48d303b\"}, {\"url\": \"https://git.kernel.org/stable/c/45fd86b444105c8bd07a763f58635c87e5dc7aea\"}, {\"url\": \"https://git.kernel.org/stable/c/8727663ded659aad55eef21e3864ebf5a4796a96\"}, {\"url\": \"https://git.kernel.org/stable/c/0260ad551b0815eb788d47f32899fbcd65d6f128\"}, {\"url\": \"https://git.kernel.org/stable/c/0d36db68fdb8a3325386fd9523b67735f944e1f3\"}, {\"url\": \"https://git.kernel.org/stable/c/8edbb9e371af186b4cf40819dab65fafe109df4d\"}, {\"url\": \"https://git.kernel.org/stable/c/5053eab38a4c4543522d0c320c639c56a8b59908\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: target: Reset t_task_cdb pointer in error case\\n\\nIf allocation of cmd-\u003et_task_cdb fails, it remains NULL but is later\\ndereferenced in the \u0027err\u0027 path.\\n\\nIn case of error, reset NULL t_task_cdb value to point at the default\\nfixed-size buffer.\\n\\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.248\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.198\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.160\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.120\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.64\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.3\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"5.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:11:26.438Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-68782\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:11:26.438Z\", \"dateReserved\": \"2025-12-24T10:30:51.036Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-01-13T15:28:56.929Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.