Skip to main content

Linux Kernel CVE-2025-68320

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Local access to LAN966x device
  2. Delivery
    Read /proc/net/dev statistics
  3. Exploit
    lan966x_stats_get takes mutex in atomic context
  4. Execution
    Sleeping-in-atomic violation / potential deadlock
  5. Impact
    Kernel warning and availability degradation

Vulnerability Assessment

Exploitation Conditions

Requires the target to run the Linux lan966x driver on Microchip LAN966x hardware, and requires a userspace read of network device statistics (e.g., /proc/net/dev, as issued by an SSH/dropbear session or monitoring tool) to reach lan966x_stats_get() in atomic context. Limiting factors: the bug is hardware/driver-specific (not present on systems without lan966x), the trigger path is a local statistics read rather than a crafted remote packet despite the CVSS AV:N claim, and impact is availability degradation (kernel warning/possible lockup) with no confidentiality or integrity effect.
Impact

Signals conflict and should be weighed carefully. The supplied CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H), attributing a network, unauthenticated, availability-only impact. However, the description shows the fault is triggered locally by a userspace read of /proc/net/dev (the dropbear/ssh process reading device statistics), which implies local rather than truly remote-network reachability - verify the attack vector with the vendor, as AV:N appears overstated. EPSS is very low (0.16%, percentile 6%), there is no KEV listing and no public exploit identified, consistent with a hard-to-weaponize, hardware-specific stability bug. The 'Information Disclosure' tag also conflicts with the CVSS impact metrics (C:N), which indicate no confidentiality impact - the realistic impact is a kernel warning/potential lockup (availability), not data disclosure. Net assessment: low real-world priority for most environments, relevant chiefly to embedded/networking devices built on LAN966x hardware.
Exploit ScenarioDerived

A local user (or a monitoring/SSH daemon such as dropbear) reads network interface statistics via /proc/net/dev on a LAN966x-based device; the driver takes a sleeping mutex in atomic context, producing a kernel warning and, under contention, a potential deadlock or lockup degrading device availability. No POC is known, and triggering requires the specific Microchip lan966x driver to be in use.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Denial of service in the Linux kernel's lan966x Ethernet switch driver (Microchip LAN966x SoC) allows a potential deadlock and kernel warning when network statistics are read while holding an atomic context. The driver incorrectly used a sleeping mutex (lan966x_stats_get) inside an atomic/spinlock-held path, tripping a 'sleeping function called from invalid context' BUG and risking system instability; the fix replaces the mutex with a spinlock. No public exploit identified at time of analysis, and the EPSS score is negligible (0.16%, 6th percentile).

RemediationAI

Upstream fix available (commits, not a tagged release): released patched version not independently confirmed - apply the stable-tree patches that replace the mutex with a spinlock in lan966x_stats_get(), referenced at https://git.kernel.org/stable/c/0216721ce71252f60d89af49c8dff613358058d3, https://git.kernel.org/stable/c/3ac743c60ec502163c435712d527eeced8d83348, https://git.kernel.org/stable/c/5a5d2f7727752b64d13263eacd9f8d08a322e662, and https://git.kernel.org/stable/c/c8ab03aa5bd9fd8bfe5d9552d8605826759fdd4d. Update to the stable kernel release that incorporates these commits for your branch. As an interim compensating control on affected embedded devices, restrict local shell/SSH access and avoid tooling that repeatedly reads /proc/net/dev, and disable kernel debug configs are not a fix - the trade-off is that limiting statistics reads reduces monitoring visibility without addressing the underlying locking defect.

Affected ProductsAI

The vulnerability affects the Linux kernel's lan966x driver for Microchip LAN966x switch hardware, observed on kernel 6.18.0-rc2 per the reported backtrace. No CPE strings were provided in the input, so exact version ranges are not enumerated by NVD here; affected stable branches are implied by the four stable-tree fix commits at git.kernel.org (0216721ce712, 3ac743c60ec5, 5a5d2f772775, c8ab03aa5bd9). Deployments are limited to systems running kernels that include the lan966x driver on the corresponding Microchip SoC/switch platforms.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the lan966x network driver in the Linux kernel, which supports Microchip LAN966x family switch/SoC hardware. The root cause is a locking discipline violation: lan966x_stats_get() acquired a sleeping mutex while the caller (dev_get_stats via the /proc/net/dev seq_file read path) executes in a non-sleepable atomic context. On kernels with lockdep/preemption debugging, __might_resched() flags this as a 'sleeping function called from invalid context' condition. Although CWE is listed as N/A, this maps conceptually to CWE-667 (Improper Locking). The remedy converts the mutex to a spinlock so the statistics accessor is safe in atomic context.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Fault is triggered by a local userspace stats read (AV:L) requiring shell/account access (PR:L); impact is availability only (kernel warning/possible lockup), no C or I impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

lan966x: Fix sleeping in atomic context

The following warning was seen when we try to connect using ssh to the device.

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 104, name: dropbear preempt_count: 1, expected: 0 INFO: lockdep is turned off. CPU: 0 UID: 0 PID: 104 Comm: dropbear Tainted: G W 6.18.0-rc2-00399-g6f1ab1b109b9-dirty #530 NONE Tainted: [W]=WARN Hardware name: Generic DT based system Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __might_resched+0x16c/0x2b0 __might_resched from __mutex_lock+0x64/0xd34 __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from lan966x_stats_get+0x5c/0x558 lan966x_stats_get from dev_get_stats+0x40/0x43c dev_get_stats from dev_seq_printf_stats+0x3c/0x184 dev_seq_printf_stats from dev_seq_show+0x10/0x30 dev_seq_show from seq_read_iter+0x350/0x4ec seq_read_iter from seq_read+0xfc/0x194 seq_read from proc_reg_read+0xac/0x100 proc_reg_read from vfs_read+0xb0/0x2b0 vfs_read from ksys_read+0x6c/0xec ksys_read from ret_fast_syscall+0x0/0x1c Exception stack(0xf0b11fa8 to 0xf0b11ff0) 1fa0: 00000001 00001000 00000008 be9048d8 00001000 00000001 1fc0: 00000001 00001000 00000008 00000003 be905920 0000001e 00000000 00000001 1fe0: 0005404c be9048c0 00018684 b6ec2cd8

It seems that we are using a mutex in a atomic context which is wrong. Change the mutex with a spinlock.

Executive ViewAI

Why It Matters

Organizations running Microchip LAN966x Ethernet switches face potential service disruptions from a kernel-level deadlock vulnerability (CVE-2025-68320, CVSS 7.5) triggered during network diagnostics operations. While assessed exploitation probability is negligible (0.2% EPSS), the absence of vendor patches and HIGH severity rating warrant immediate asset inventory and access controls to reduce operational risk.

Business Impact: Medium
Compensating Controls

Restrict network statistics and diagnostic queries to maintenance windows outside atomic/critical operations; configure system monitoring to alert on kernel BUG warnings related to this driver; document and train operations teams on manual driver restart procedures; consider temporary driver disabling on non-critical deployments; establish change control for kernel updates affecting switch drivers.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Low
Microchip LAN966x is niche embedded switch/SoC hardware, limited footprint
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/336860 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0447/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0472/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0587/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20479/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20498/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20555/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20570/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20599/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20615/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ REF https://git.kernel.org/stable/c/0216721ce71252f60d89af49c8dff613358058d3 REF https://git.kernel.org/stable/c/3ac743c60ec502163c435712d527eeced8d83348 REF https://git.kernel.org/stable/c/5a5d2f7727752b64d13263eacd9f8d08a322e662 REF https://git.kernel.org/stable/c/c8ab03aa5bd9fd8bfe5d9552d8605826759fdd4d REF https://git.kernel.org/stable/c/cabb8cbeab49f4b74d78a91a277e00d4f6dd5d7d

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy