Skip to main content

Linux Kernel CVE-2025-68250

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
High
Disputed · 8.2 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vuln.today AI
2.5 LOW

Trigger requires running on a rarely-used 2-byte-aligned architecture and local task activity (AV:L/AC:H/PR:L); impact is log-noise/diagnostic disruption only, so at most A:L and no C/I impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:18 vuln.today
CVE Published
Dec 16, 2025 - 15:15 cve.org
HIGH 8.2

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hung_task: fix warnings caused by unaligned lock pointers

The blocker tracking mechanism assumes that lock pointers are at least 4-byte aligned to use their lower bits for type encoding.

However, as reported by Eero Tamminen, some architectures like m68k only guarantee 2-byte alignment of 32-bit values. This breaks the assumption and causes two related WARN_ON_ONCE checks to trigger.

To fix this, the runtime checks are adjusted to silently ignore any lock that is not 4-byte aligned, effectively disabling the feature in such cases and avoiding the related warnings.

Thanks to Geert Uytterhoeven for bisecting!

AnalysisAI

Spurious kernel warnings in the Linux kernel hung_task blocker-tracking mechanism arise on architectures that align 32-bit values on 2-byte boundaries (e.g., m68k), where the code incorrectly assumes lock pointers are always 4-byte aligned so it can pack a type tag into the lower two pointer bits. The mismatch trips two WARN_ON_ONCE checks; the fix silently ignores non-4-byte-aligned locks, disabling the feature on those platforms. This is an internal kernel robustness fix rather than a remotely reachable attack primitive, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).

Technical ContextAI

The affected component is the kernel's hung_task detector, which since recent releases records a 'blocker' pointer to identify which lock a hung task is waiting on. To store both the pointer and a small type discriminator in a single word, the implementation reuses the lower two bits of the lock address, a common pointer-tagging trick that depends on the object being at least 4-byte aligned. On most architectures (x86, arm64) the ABI guarantees natural 4-byte alignment for 32-bit values, but the m68k ABI only guarantees 2-byte alignment, so a validly-placed lock can have a non-zero low bit that the tag-encoding/decoding logic and its WARN_ON_ONCE sanity checks do not expect. No CWE was assigned by NVD; the closest root-cause class is an incorrect alignment/type-confusion assumption in pointer bit-packing. CPE data was not provided in the input, so exact affected kernel version ranges are not enumerable from this feed alone.

Affected ProductsAI

The Linux kernel is affected, specifically the hung_task blocker-tracking code, on architectures that only guarantee 2-byte alignment of 32-bit values (notably m68k). No CPE strings or explicit version ranges were supplied in the input, so the precise vulnerable-to-fixed kernel version window cannot be stated with confidence from this data. The fix is documented in the stable-tree commits at https://git.kernel.org/stable/c/c0e2dcbe54cb15ecdf9d8f4501c6720423243888 and https://git.kernel.org/stable/c/c97513cddcfc235f2522617980838e500af21d01.

RemediationAI

Upstream fix available (stable-tree commits); a released, tagged patched kernel version was not independently confirmed from the provided data - update to a distribution kernel that incorporates commits c0e2dcbe54cb15ecdf9d8f4501c6720423243888 and c97513cddcfc235f2522617980838e500af21d01 (https://git.kernel.org/stable/c/c0e2dcbe54cb15ecdf9d8f4501c6720423243888 and https://git.kernel.org/stable/c/c97513cddcfc235f2522617980838e500af21d01). The fix makes the runtime checks skip any lock that is not 4-byte aligned, effectively disabling blocker tracking on affected architectures with no functional side effect beyond loss of that diagnostic detail on those platforms. As an interim measure on impacted systems, the hung_task detector can be tuned or disabled via the kernel.hung_task_warnings, kernel.hung_task_timeout_secs, or CONFIG_DETECT_HUNG_TASK settings to suppress the noise, with the trade-off of reduced visibility into genuinely hung tasks.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68250 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy