Skip to main content

Linux Kernel CVE-2025-68320

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Fault is triggered by a local userspace stats read (AV:L) requiring shell/account access (PR:L); impact is availability only (kernel warning/possible lockup), no C or I impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:09 vuln.today
CVE Published
Dec 16, 2025 - 16:16 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

lan966x: Fix sleeping in atomic context

The following warning was seen when we try to connect using ssh to the device.

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 104, name: dropbear preempt_count: 1, expected: 0 INFO: lockdep is turned off. CPU: 0 UID: 0 PID: 104 Comm: dropbear Tainted: G W 6.18.0-rc2-00399-g6f1ab1b109b9-dirty #530 NONE Tainted: [W]=WARN Hardware name: Generic DT based system Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __might_resched+0x16c/0x2b0 __might_resched from __mutex_lock+0x64/0xd34 __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from lan966x_stats_get+0x5c/0x558 lan966x_stats_get from dev_get_stats+0x40/0x43c dev_get_stats from dev_seq_printf_stats+0x3c/0x184 dev_seq_printf_stats from dev_seq_show+0x10/0x30 dev_seq_show from seq_read_iter+0x350/0x4ec seq_read_iter from seq_read+0xfc/0x194 seq_read from proc_reg_read+0xac/0x100 proc_reg_read from vfs_read+0xb0/0x2b0 vfs_read from ksys_read+0x6c/0xec ksys_read from ret_fast_syscall+0x0/0x1c Exception stack(0xf0b11fa8 to 0xf0b11ff0) 1fa0: 00000001 00001000 00000008 be9048d8 00001000 00000001 1fc0: 00000001 00001000 00000008 00000003 be905920 0000001e 00000000 00000001 1fe0: 0005404c be9048c0 00018684 b6ec2cd8

It seems that we are using a mutex in a atomic context which is wrong. Change the mutex with a spinlock.

AnalysisAI

Denial of service in the Linux kernel's lan966x Ethernet switch driver (Microchip LAN966x SoC) allows a potential deadlock and kernel warning when network statistics are read while holding an atomic context. The driver incorrectly used a sleeping mutex (lan966x_stats_get) inside an atomic/spinlock-held path, tripping a 'sleeping function called from invalid context' BUG and risking system instability; the fix replaces the mutex with a spinlock. No public exploit identified at time of analysis, and the EPSS score is negligible (0.16%, 6th percentile).

Technical ContextAI

The affected component is the lan966x network driver in the Linux kernel, which supports Microchip LAN966x family switch/SoC hardware. The root cause is a locking discipline violation: lan966x_stats_get() acquired a sleeping mutex while the caller (dev_get_stats via the /proc/net/dev seq_file read path) executes in a non-sleepable atomic context. On kernels with lockdep/preemption debugging, __might_resched() flags this as a 'sleeping function called from invalid context' condition. Although CWE is listed as N/A, this maps conceptually to CWE-667 (Improper Locking). The remedy converts the mutex to a spinlock so the statistics accessor is safe in atomic context.

Affected ProductsAI

The vulnerability affects the Linux kernel's lan966x driver for Microchip LAN966x switch hardware, observed on kernel 6.18.0-rc2 per the reported backtrace. No CPE strings were provided in the input, so exact version ranges are not enumerated by NVD here; affected stable branches are implied by the four stable-tree fix commits at git.kernel.org (0216721ce712, 3ac743c60ec5, 5a5d2f772775, c8ab03aa5bd9). Deployments are limited to systems running kernels that include the lan966x driver on the corresponding Microchip SoC/switch platforms.

RemediationAI

Upstream fix available (commits, not a tagged release): released patched version not independently confirmed - apply the stable-tree patches that replace the mutex with a spinlock in lan966x_stats_get(), referenced at https://git.kernel.org/stable/c/0216721ce71252f60d89af49c8dff613358058d3, https://git.kernel.org/stable/c/3ac743c60ec502163c435712d527eeced8d83348, https://git.kernel.org/stable/c/5a5d2f7727752b64d13263eacd9f8d08a322e662, and https://git.kernel.org/stable/c/c8ab03aa5bd9fd8bfe5d9552d8605826759fdd4d. Update to the stable kernel release that incorporates these commits for your branch. As an interim compensating control on affected embedded devices, restrict local shell/SSH access and avoid tooling that repeatedly reads /proc/net/dev, and disable kernel debug configs are not a fix - the trade-off is that limiting statistics reads reduces monitoring visibility without addressing the underlying locking defect.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2025-68320 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy