What is the CVSS score of CVE-2025-68336?

CVE-2025-68336 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2025-68336?

A denial-of-service vulnerability in Linux kernel debugging instrumentation (CVE-2025-68336) creates service availability risk for organizations running kernels with lock debugging enabled.. A patch is available.

How to fix or mitigate CVE-2025-68336?

Within 24 hours, identify all Linux systems with kernel lock debugging enabled by querying system configurations and kernel boot parameters to scope exposure. Within 7 days, assess which affected systems are production-critical and create a prioritization matrix; coordinate with infrastructure teams to track kernel security advisories for patch availability. Within 30 days, either apply the vendor-released patch when available or implement mitigations by disabling kernel lock debugging (debug_write_lock) on non-critical systems, prioritizing production environments with strict uptime requirements.

Linux Kernel CVE-2025-68336

HIGH

2025-12-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Red Hat Suse

High

Disputed · 7.5 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Low–High)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

2.5 LOW

Local, timing-dependent race reachable only in lock-debug builds by an existing local task, so AV:L/AC:H/PR:L; no data exposure and only minor availability impact, hence C:N/I:N/A:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 07:08 vuln.today

CVE Published

Dec 22, 2025 - 17:16 cve.org

HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

locking/spinlock/debug: Fix data-race in do_raw_write_lock

KCSAN reports:

BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock

write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1: do_raw_write_lock+0x120/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork

read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0: do_raw_write_lock+0x88/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork

value changed: 0xffffffff -> 0x00000001

Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111

Commit 1a365e822372 ("locking/spinlock/debug: Fix various data races") has adressed most of these races, but seems to be not consistent/not complete.

>From do_raw_write_lock() only debug_write_lock_after() part has been converted to WRITE_ONCE(), but not debug_write_lock_before() part. Do it now.

AnalysisAI

Denial-of-service potential in the Linux kernel's spinlock debugging instrumentation (do_raw_write_lock) stems from an unmarked read/write in debug_write_lock_before(), producing a data-race flagged by the Kernel Concurrency Sanitizer (KCSAN). Only kernels built with lock debugging enabled are affected, and the fix completes prior race-hardening work (commit 1a365e822372) by converting the remaining access to WRITE_ONCE(). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).

Technical ContextAI

The affected code is the kernel's spinlock debug layer (kernel/locking/spinlock_debug.c), which adds sanity-checking around raw write-lock acquisition. In do_raw_write_lock(), the earlier hardening commit 1a365e822372 ('locking/spinlock/debug: Fix various data races') applied WRITE_ONCE() to the debug_write_lock_after() path but left debug_write_lock_before() using an un-annotated access to the lock owner/state word. Two CPUs concurrently executing _raw_write_lock_irq (observed here on the do_exit / call_usermodehelper_exec_async path) can therefore read and write the same 4-byte field without proper annotation. The root cause is a concurrency/data-race class defect (CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization); NVD lists the CWE as N/A. This is instrumentation code active only under CONFIG_DEBUG_SPINLOCK/CONFIG_DEBUG_LOCK_ALLOC-style debug builds, not in production defconfig kernels.

Affected ProductsAI

The Linux kernel is affected specifically in the spinlock debug instrumentation (do_raw_write_lock via debug_write_lock_before). The reporting reproduction was on kernel 6.1.111 (Comm: kworker/u4:1), and the eight stable-tree git.kernel.org commit references indicate the fix was backported across multiple stable branches, implying a range of long-lived stable and mainline versions prior to those fix commits are affected. No specific vendor CPE list or fixed tagged release version was provided in the input; affected versions are those built with spinlock lock-debugging enabled up to the referenced stable fix commits (e.g., https://git.kernel.org/stable/c/16b3590c0e1e615757dade098c8fbc0d4f040c76 and the seven sibling commits).

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update from your distribution that incorporates the stable-tree fix commits listed at git.kernel.org (e.g., https://git.kernel.org/stable/c/16b3590c0e1e615757dade098c8fbc0d4f040c76, https://git.kernel.org/stable/c/396a9270a7b90886be501611b13aa636f2e8c703, and the six additional referenced commits), which mark the remaining access in debug_write_lock_before() with WRITE_ONCE(). As a compensating control if patching must be deferred, disable kernel lock debugging (build/boot a kernel without CONFIG_DEBUG_SPINLOCK / lock-debug options), which removes the affected instrumentation entirely - the trade-off is losing spinlock sanity checking useful for kernel development, though production defconfig kernels typically ship without it and are unaffected. No firewall or network control is relevant here since the flaw is not network-reachable.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected

CVE-2025-68336 vulnerability details – vuln.today

Back

Linux Kernel CVE-2025-68336

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code