CVE-2025-68319
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-16

Last updated on: 2025-12-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netconsole: Acquire su_mutex before navigating configs hierarchy There is a race between operations that iterate over the userdata cg_children list and concurrent add/remove of userdata items through configfs. The update_userdata() function iterates over the nt->userdata_group.cg_children list, and count_extradata_entries() also iterates over this same list to count nodes. Quoting from Documentation/filesystems/configfs.rst: > A subsystem can navigate the cg_children list and the ci_parent pointer > to see the tree created by the subsystem. This can race with configfs' > management of the hierarchy, so configfs uses the subsystem mutex to > protect modifications. Whenever a subsystem wants to navigate the > hierarchy, it must do so under the protection of the subsystem > mutex. Without proper locking, if a userdata item is added or removed concurrently while these functions are iterating, the list can be accessed in an inconsistent state. For example, the list_for_each() loop can reach a node that is being removed from the list by list_del_init() which sets the nodes' .next pointer to point to itself, so the loop will never end (or reach the WARN_ON_ONCE in update_userdata() ). Fix this by holding the configfs subsystem mutex (su_mutex) during all operations that iterate over cg_children. This includes: - userdatum_value_store() which calls update_userdata() to iterate over cg_children - All sysdata_*_enabled_store() functions which call count_extradata_entries() to iterate over cg_children The su_mutex must be acquired before dynamic_netconsole_mutex to avoid potential lock ordering issues, as configfs operations may already hold su_mutex when calling into our code.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-16
Last Modified
2025-12-18
Generated
2026-05-07
AI Q&A
2025-12-16
EPSS Evaluated
2026-05-05
NVD
CVE-2025-68319
EUVD
EUVD-2025-203750
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the Linux kernel's netconsole feature involves a race condition when iterating over the userdata cg_children list. Specifically, functions like update_userdata() and count_extradata_entries() iterate over this list without proper locking, while concurrent add or remove operations on userdata items through configfs can modify the list. Without acquiring the configfs subsystem mutex (su_mutex), the list can be accessed in an inconsistent state, potentially causing infinite loops or warnings due to nodes being removed during iteration. The fix involves acquiring the su_mutex before iterating over the list to ensure safe concurrent access.


How can this vulnerability impact me? :

This vulnerability can cause the Linux kernel's netconsole subsystem to behave unpredictably due to race conditions when accessing the userdata list. This may lead to infinite loops or kernel warnings, potentially causing system instability or crashes. Such instability could affect system reliability and availability.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, ensure that the Linux kernel is updated to a version where the fix is applied. The fix involves acquiring the configfs subsystem mutex (su_mutex) before iterating over the cg_children list to prevent race conditions. Specifically, the su_mutex must be held during all operations that iterate over cg_children, including userdatum_value_store() and sysdata_*_enabled_store() functions. Additionally, ensure that su_mutex is acquired before dynamic_netconsole_mutex to avoid lock ordering issues.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart