CVE-2025-68823 Linux CVE debrief

Who should care

Linux system administrators running kernels with ublk support; virtualization and container platform operators using userspace block devices; embedded systems leveraging ublk for storage virtualization

Technical summary

The vulnerability exists in the ublk driver's request completion path. When __ublk_complete_rq() calls blk_update_request() or blk_mq_end_request(), bio completion callbacks may trigger fput() on the ublk block device file descriptor. The fput() implementation can defer to the current task's task work, which then executes blkdev_release() in the same task context. Since bdev_open() already holds disk->open_mutex, the reentrant attempt to acquire it in blkdev_release() causes a self-deadlock. The fix runs these completion routines with local bottom halves disabled, which prevents task_work from running in the current context and instead schedules the release to a kernel work-queue, allowing the original mutex holder to complete and release it.

Defensive priority

medium

Recommended defensive actions

• Apply stable kernel patches for affected versions (6.0.x through 6.6.124, 6.7.x through 6.12.70, 6.13.x through 6.18.3, and 6.19-rc1) from the Linux kernel stable tree
• Upgrade to patched kernel versions: 6.6.125+, 6.12.71+, 6.18.4+, or later stable releases
• Monitor systems using ublk (userspace block devices) for hung task warnings or processes stuck in D-state during partition table reads
• If patching is not immediately feasible, consider avoiding concurrent ublk device open/release operations that trigger partition table reads
• Review system logs for ublk-related deadlock traces as indicators of exploitation or trigger conditions

Evidence notes

CVE published 2026-01-13; modified 2026-06-01. NVD records CVSS 3.1 score 5.5 (MEDIUM) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. CPE criteria indicate affected Linux kernel versions: 6.0 through 6.6.124, 6.7 through 6.12.70, 6.13 through 6.18.3, and 6.19-rc1. CWE-667 (Improper Locking) classified. Five kernel.org stable branch commits provided as patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.