Junglewise Threat Intelligence

CVE-2025-68320: Linux Kernel lan966x driver sleeping in atomic context

CVE-2025-68320 · Severity: high · CVSS 7.5 · Published 2025-12-16

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's lan966x network driver could cause a system crash or instability when network statistics are accessed, such as during an SSH connection. This issue occurs because the system incorrectly attempts to pause a process in a high-priority state where pausing is not allowed. An exploit could lead to a denial-of-service, impacting the availability of devices using this specific Microchip network hardware.

Technical details

The vulnerability is a 'sleeping in atomic context' bug within the lan966x driver (specifically in lan966x_stats_get). The root cause is the use of a mutex_lock within an atomic context, which triggers a kernel warning or panic because mutexes can sleep, and sleeping is prohibited in atomic contexts. This was observed during network activity such as SSH connections when dev_get_stats is called. The fix involves replacing the mutex with a spinlock to ensure synchronization without violating atomic context constraints. The issue affects Linux kernel versions from 5.17 up to the fix in 6.18-rc2.

Affected products

  • Linux Linux Kernel 5.17 to 6.18-rc2

Timeline

  • 2025-11-05: patched: Initial patch submitted by Horatiu Vultur
  • 2025-12-16: disclosed: CVE-2025-68320 published

References

Related threats