CVE-2025-68214

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68214", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T13:41:40.256Z", "datePublished": "2025-12-16T13:57:09.728Z", "dateUpdated": "2026-11-05T21:23:07.984Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:02:22.475Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntimers: Fix NULL function pointer race in timer_shutdown_sync()\n\nThere is a race condition between timer_shutdown_sync() and timer\nexpiration that can lead to hitting a WARN_ON in expire_timers().\n\nThe issue occurs when timer_shutdown_sync() clears the timer function\nto NULL while the timer is still running on another CPU. The race\nscenario looks like this:\n\nCPU0\t\t\t\t\tCPU1\n\t\t\t\t\t<SOFTIRQ>\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tbase->running_timer = timer;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t[call_timer_fn enter]\n\t\t\t\t\tmod_timer()\n\t\t\t\t\t...\ntimer_shutdown_sync()\nlock_timer_base()\n// For now, will not detach the timer but only clear its function to NULL\nif (base->running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer->function = NULL;\nunlock_timer_base()\n\t\t\t\t\t[call_timer_fn exit]\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\tbase->running_timer = NULL;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t...\n\t\t\t\t\t// Now timer is pending while its function set to NULL.\n\t\t\t\t\t// next timer trigger\n\t\t\t\t\t<SOFTIRQ>\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tWARN_ON_ONCE(!fn) // hit\n\t\t\t\t\t...\nlock_timer_base()\n// Now timer will detach\nif (base->running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer->function = NULL;\nunlock_timer_base()\n\nThe problem is that timer_shutdown_sync() clears the timer function\nregardless of whether the timer is currently running. This can leave a\npending timer with a NULL function pointer, which triggers the\nWARN_ON_ONCE(!fn) check in expire_timers().\n\nFix this by only clearing the timer function when actually detaching the\ntimer. If the timer is running, leave the function pointer intact, which is\nsafe because the timer will be properly detached when it finishes running."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/time/timer.c"], "versions": [{"version": "debbcf812d735003c96c5e5968a3cfa4e1fbd1af", "lessThan": "ba43ac025c4318241f8edf94f31d2eebab86991b", "status": "affected", "versionType": "git"}, {"version": "334c33aa487be406a149c8b87c38c8399d2dba8d", "lessThan": "1a975716cc8977f461e45e28e3e5977d46ad7a6a", "status": "affected", "versionType": "git"}, {"version": "0cc04e80458a822300b93f82ed861a513edde194", "lessThan": "6665fbd7730b26d770c232b20d1b907e6a67a914", "status": "affected", "versionType": "git"}, {"version": "0cc04e80458a822300b93f82ed861a513edde194", "lessThan": "176725f4848376530a0f0da9023f956afcc33585", "status": "affected", "versionType": "git"}, {"version": "0cc04e80458a822300b93f82ed861a513edde194", "lessThan": "a01efa7a780c42ac5170a949bd95c9786ffcc60a", "status": "affected", "versionType": "git"}, {"version": "0cc04e80458a822300b93f82ed861a513edde194", "lessThan": "20739af07383e6eb1ec59dcd70b72ebfa9ac362c", "status": "affected", "versionType": "git"}, {"version": "6.1.158", "lessThan": "6.1.159", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/time/timer.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.159", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.118", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.60", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.10", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.158", "versionEndExcluding": "6.1.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.118"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.17.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ba43ac025c4318241f8edf94f31d2eebab86991b"}, {"url": "https://git.kernel.org/stable/c/1a975716cc8977f461e45e28e3e5977d46ad7a6a"}, {"url": "https://git.kernel.org/stable/c/6665fbd7730b26d770c232b20d1b907e6a67a914"}, {"url": "https://git.kernel.org/stable/c/176725f4848376530a0f0da9023f956afcc33585"}, {"url": "https://git.kernel.org/stable/c/a01efa7a780c42ac5170a949bd95c9786ffcc60a"}, {"url": "https://git.kernel.org/stable/c/20739af07383e6eb1ec59dcd70b72ebfa9ac362c"}], "title": "timers: Fix NULL function pointer race in timer_shutdown_sync()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68214", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:13:54.279027Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:23:07.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68214", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:13:54.279027Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:13:55.351Z"}}], "cna": {"title": "timers: Fix NULL function pointer race in timer_shutdown_sync()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "debbcf812d735003c96c5e5968a3cfa4e1fbd1af", "lessThan": "ba43ac025c4318241f8edf94f31d2eebab86991b", "versionType": "git"}, {"status": "affected", "version": "334c33aa487be406a149c8b87c38c8399d2dba8d", "lessThan": "1a975716cc8977f461e45e28e3e5977d46ad7a6a", "versionType": "git"}, {"status": "affected", "version": "0cc04e80458a822300b93f82ed861a513edde194", "lessThan": "6665fbd7730b26d770c232b20d1b907e6a67a914", "versionType": "git"}, {"status": "affected", "version": "0cc04e80458a822300b93f82ed861a513edde194", "lessThan": "176725f4848376530a0f0da9023f956afcc33585", "versionType": "git"}, {"status": "affected", "version": "0cc04e80458a822300b93f82ed861a513edde194", "lessThan": "a01efa7a780c42ac5170a949bd95c9786ffcc60a", "versionType": "git"}, {"status": "affected", "version": "0cc04e80458a822300b93f82ed861a513edde194", "lessThan": "20739af07383e6eb1ec59dcd70b72ebfa9ac362c", "versionType": "git"}, {"status": "affected", "version": "6.1.158", "lessThan": "6.1.159", "versionType": "semver"}], "programFiles": ["kernel/time/timer.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.159", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.118", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.60", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.10", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/time/timer.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ba43ac025c4318241f8edf94f31d2eebab86991b"}, {"url": "https://git.kernel.org/stable/c/1a975716cc8977f461e45e28e3e5977d46ad7a6a"}, {"url": "https://git.kernel.org/stable/c/6665fbd7730b26d770c232b20d1b907e6a67a914"}, {"url": "https://git.kernel.org/stable/c/176725f4848376530a0f0da9023f956afcc33585"}, {"url": "https://git.kernel.org/stable/c/a01efa7a780c42ac5170a949bd95c9786ffcc60a"}, {"url": "https://git.kernel.org/stable/c/20739af07383e6eb1ec59dcd70b72ebfa9ac362c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntimers: Fix NULL function pointer race in timer_shutdown_sync()\n\nThere is a race condition between timer_shutdown_sync() and timer\nexpiration that can lead to hitting a WARN_ON in expire_timers().\n\nThe issue occurs when timer_shutdown_sync() clears the timer function\nto NULL while the timer is still running on another CPU. The race\nscenario looks like this:\n\nCPU0\t\t\t\t\tCPU1\n\t\t\t\t\t<SOFTIRQ>\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tbase->running_timer = timer;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t[call_timer_fn enter]\n\t\t\t\t\tmod_timer()\n\t\t\t\t\t...\ntimer_shutdown_sync()\nlock_timer_base()\n// For now, will not detach the timer but only clear its function to NULL\nif (base->running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer->function = NULL;\nunlock_timer_base()\n\t\t\t\t\t[call_timer_fn exit]\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\tbase->running_timer = NULL;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t...\n\t\t\t\t\t// Now timer is pending while its function set to NULL.\n\t\t\t\t\t// next timer trigger\n\t\t\t\t\t<SOFTIRQ>\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tWARN_ON_ONCE(!fn) // hit\n\t\t\t\t\t...\nlock_timer_base()\n// Now timer will detach\nif (base->running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer->function = NULL;\nunlock_timer_base()\n\nThe problem is that timer_shutdown_sync() clears the timer function\nregardless of whether the timer is currently running. This can leave a\npending timer with a NULL function pointer, which triggers the\nWARN_ON_ONCE(!fn) check in expire_timers().\n\nFix this by only clearing the timer function when actually detaching the\ntimer. If the timer is running, leave the function pointer intact, which is\nsafe because the timer will be properly detached when it finishes running."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.159", "versionStartIncluding": "6.1.158"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.118", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.60", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.10", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "6.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:02:22.475Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68214", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:23:07.984Z", "dateReserved": "2025-12-16T13:41:40.256Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-16T13:57:09.728Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/time/timer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ba43ac025c4318241f8edf94f31d2eebab86991b", "status": "affected", "version": "debbcf812d735003c96c5e5968a3cfa4e1fbd1af", "versionType": "git"}, {"lessThan": "1a975716cc8977f461e45e28e3e5977d46ad7a6a", "status": "affected", "version": "334c33aa487be406a149c8b87c38c8399d2dba8d", "versionType": "git"}, {"lessThan": "6665fbd7730b26d770c232b20d1b907e6a67a914", "status": "affected", "version": "0cc04e80458a822300b93f82ed861a513edde194", "versionType": "git"}, {"lessThan": "176725f4848376530a0f0da9023f956afcc33585", "status": "affected", "version": "0cc04e80458a822300b93f82ed861a513edde194", "versionType": "git"}, {"lessThan": "a01efa7a780c42ac5170a949bd95c9786ffcc60a", "status": "affected", "version": "0cc04e80458a822300b93f82ed861a513edde194", "versionType": "git"}, {"lessThan": "20739af07383e6eb1ec59dcd70b72ebfa9ac362c", "status": "affected", "version": "0cc04e80458a822300b93f82ed861a513edde194", "versionType": "git"}, {"lessThan": "6.1.159", "status": "affected", "version": "6.1.158", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/time/timer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.159", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.118", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.60", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4391A667-3800-46E2-85F1-05D3343C6133", "versionEndExcluding": "6.6.118", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "959A7F68-3804-4797-BE3E-A69E525AD284", "versionEndExcluding": "6.12.60", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "51C8475C-4E3F-464D-AE0C-4D52A8C3240E", "versionEndExcluding": "6.17.10", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1.158:*:*:*:*:*:*:*", "matchCriteriaId": "25E9EB3F-E8EC-414C-81DF-651BF201C40C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc1:*:*:*:*:*:*", "matchCriteriaId": "DD01661D-DFC8-4B6D-80E7-46D203CC4565", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:*", "matchCriteriaId": "A8A65C5A-918F-4E0B-8E98-08A29FFBA58A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*", "matchCriteriaId": "26CA425A-E44F-49D2-92D9-1DDD56398440", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*", "matchCriteriaId": "BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*", "matchCriteriaId": "2545FB83-C4A6-4F62-9ED1-09F75D2E3C78", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*", "matchCriteriaId": "E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntimers: Fix NULL function pointer race in timer_shutdown_sync()\n\nThere is a race condition between timer_shutdown_sync() and timer\nexpiration that can lead to hitting a WARN_ON in expire_timers().\n\nThe issue occurs when timer_shutdown_sync() clears the timer function\nto NULL while the timer is still running on another CPU. The race\nscenario looks like this:\n\nCPU0\t\t\t\t\tCPU1\n\t\t\t\t\t<SOFTIRQ>\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tbase->running_timer = timer;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t[call_timer_fn enter]\n\t\t\t\t\tmod_timer()\n\t\t\t\t\t...\ntimer_shutdown_sync()\nlock_timer_base()\n// For now, will not detach the timer but only clear its function to NULL\nif (base->running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer->function = NULL;\nunlock_timer_base()\n\t\t\t\t\t[call_timer_fn exit]\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\tbase->running_timer = NULL;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t...\n\t\t\t\t\t// Now timer is pending while its function set to NULL.\n\t\t\t\t\t// next timer trigger\n\t\t\t\t\t<SOFTIRQ>\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tWARN_ON_ONCE(!fn) // hit\n\t\t\t\t\t...\nlock_timer_base()\n// Now timer will detach\nif (base->running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer->function = NULL;\nunlock_timer_base()\n\nThe problem is that timer_shutdown_sync() clears the timer function\nregardless of whether the timer is currently running. This can leave a\npending timer with a NULL function pointer, which triggers the\nWARN_ON_ONCE(!fn) check in expire_timers().\n\nFix this by only clearing the timer function when actually detaching the\ntimer. If the timer is running, leave the function pointer intact, which is\nsafe because the timer will be properly detached when it finishes running."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntemporizadores: Corrige la condici\u00f3n de carrera del puntero de funci\u00f3n NULL en timer_shutdown_sync()\n\nExiste una condici\u00f3n de carrera entre timer_shutdown_sync() y la expiraci\u00f3n del temporizador que puede llevar a activar un WARN_ON en expire_timers().\n\nEl problema ocurre cuando timer_shutdown_sync() borra la funci\u00f3n del temporizador a NULL mientras el temporizador todav\u00eda se est\u00e1 ejecutando en otra CPU. El escenario de la condici\u00f3n de carrera es el siguiente:\n\nCPU0\t\t\t\t\tCPU1\n\t\t\t\t\t<SOFTIRQ>\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tbase -> running_timer = timer;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t[call_timer_fn enter]\n\t\t\t\t\tmod_timer()\n\t\t\t\t\t...\ntimer_shutdown_sync()\nlock_timer_base()\n// Por ahora, no desvincular\u00e1 el temporizador, sino que solo borrar\u00e1 su funci\u00f3n a NULL\nif (base -> running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer -> function = NULL;\nunlock_timer_base()\n\t\t\t\t\t[call_timer_fn exit]\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\tbase -> running_timer = NULL;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t...\n\t\t\t\t\t// Ahora el temporizador est\u00e1 pendiente mientras su funci\u00f3n est\u00e1 establecida en NULL.\n\t\t\t\t\t// siguiente activaci\u00f3n del temporizador\n\t\t\t\t\t<SOFTIRQ>\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tWARN_ON_ONCE(!fn) // activado\n\t\t\t\t\t...\nlock_timer_base()\n// Ahora el temporizador se desvincular\u00e1\nif (base -> running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer -> function = NULL;\nunlock_timer_base()\n\nEl problema es que timer_shutdown_sync() borra la funci\u00f3n del temporizador independientemente de si el temporizador se est\u00e1 ejecutando actualmente. Esto puede dejar un temporizador pendiente con un puntero de funci\u00f3n NULL, lo que activa la comprobaci\u00f3n WARN_ON_ONCE(!fn) en expire_timers().\n\nSolucione esto borrando la funci\u00f3n del temporizador solo cuando se desvincula realmente el temporizador. Si el temporizador se est\u00e1 ejecutando, deje el puntero de funci\u00f3n intacto, lo cual es seguro porque el temporizador se desvincular\u00e1 correctamente cuando termine de ejecutarse."}], "id": "CVE-2025-68214", "lastModified": "2026-11-05T22:17:36.573", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68214", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:13:54.279027Z", "version": "2.0.3"}}]}, "published": "2025-12-16T14:15:54.363", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/176725f4848376530a0f0da9023f956afcc33585"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1a975716cc8977f461e45e28e3e5977d46ad7a6a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/20739af07383e6eb1ec59dcd70b72ebfa9ac362c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6665fbd7730b26d770c232b20d1b907e6a67a914"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a01efa7a780c42ac5170a949bd95c9786ffcc60a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ba43ac025c4318241f8edf94f31d2eebab86991b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: timers: Fix NULL function pointer race in timer_shutdown_sync()", "id": "2422686", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422686"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-68214", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68214\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68214\nhttps://lore.kernel.org/linux-cve-announce/2025121631-CVE-2025-68214-1871@gregkh/T"], "threat_severity": "Low"}

{}