Executive brief
A vulnerability was identified in the Linux kernel's locking mechanism, which is responsible for managing how different parts of the system access shared resources. A data race in the spinlock debugging code could lead to system instability or crashes. This impact primarily affects system availability, potentially causing service interruptions in environments where kernel debugging features are active.
Technical details
A data race exists in the Linux kernel within 'kernel/locking/spinlock_debug.c'. The vulnerability occurs in 'do_raw_write_lock' because the 'debug_write_lock_before' function lacks proper atomic access (READ_ONCE) for 'lock->owner' and 'lock->owner_cpu', while the 'after' counterpart was previously patched. This inconsistency allows concurrent tasks to trigger race conditions detected by KCSAN. An attacker could potentially exploit this to cause a kernel panic or denial of service. The issue has been resolved by ensuring consistent use of READ_ONCE() macros in the debugging logic across multiple stable kernel branches.
Affected products
- Linux Linux Kernel Affected from commit 1a365e822372 up to fixed versions in 4.19.y, 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.12.y, and 6.13.y
Timeline
- 2025-09-19: disclosed: Initial patch authored
- 2025-12-12: patched: Patch committed to stable branches
- 2025-12-22: advisory: CVE published
References
- https://git.kernel.org/stable/c/16b3590c0e1e615757dade098c8fbc0d4f040c76
- https://git.kernel.org/stable/c/396a9270a7b90886be501611b13aa636f2e8c703
- https://git.kernel.org/stable/c/39d2ef113416f1a4205b03fb0aa2e428d1412c77
- https://git.kernel.org/stable/c/8e5b2cf10844402054b52b489b525dc30cc16908
- https://git.kernel.org/stable/c/93bd23524d63deb80fb85beb2e43fafeb1043d0f
- https://git.kernel.org/stable/c/b163a5e8c703201c905d6ec7920ed79d167e8442
- https://git.kernel.org/stable/c/c14ecb555c3ee80eeb030a4e46d00e679537f03a