Executive brief
A vulnerability in the Linux kernel's networking component can cause a system deadlock, leading to a complete service outage. This occurs when the system attempts to clean up network namespaces while certain network traffic fragments are still being processed. An attacker or a specific sequence of administrative actions could trigger this hang, requiring a hard reboot to restore operations.
Technical details
A deadlock exists in the Linux kernel's 'inet' fragment handling due to a circular dependency during network namespace (netns) exit. Specifically, 'conntrack' references held by socket buffers (skbs) in fragmentation queues prevent 'nf_conntrack_cleanup_net_list()' from completing. Because 'nf_defrag_ipv6' hooks run after 'conntrack' hooks during exit, the references are not released in time, causing a permanent loop while holding 'pernet_ops_rwsem'. This blocks other tasks, such as 'modprobe', from acquiring the semaphore. The fix introduces 'fqdir_pre_exit()' to explicitly flush pending fragment queues and release conntrack references before the cleanup process begins.
Affected products
- Linux Linux Kernel Fixed in 6.1.120, 6.6.64, 6.12.4, and later
Timeline
- 2025-12-06: other: Initial patch authored
- 2026-01-13: advisory: CVE-2025-68768 published