CVE-2025-68319

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68319", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T14:48:05.295Z", "datePublished": "2025-12-16T15:39:48.903Z", "dateUpdated": "2026-10-21T12:38:12.214Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:38:12.214Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: Acquire su_mutex before navigating configs hierarchy\n\nThere is a race between operations that iterate over the userdata\ncg_children list and concurrent add/remove of userdata items through\nconfigfs. The update_userdata() function iterates over the\nnt->userdata_group.cg_children list, and count_extradata_entries() also\niterates over this same list to count nodes.\n\nQuoting from Documentation/filesystems/configfs.rst:\n> A subsystem can navigate the cg_children list and the ci_parent pointer\n> to see the tree created by the subsystem. This can race with configfs'\n> management of the hierarchy, so configfs uses the subsystem mutex to\n> protect modifications. Whenever a subsystem wants to navigate the\n> hierarchy, it must do so under the protection of the subsystem\n> mutex.\n\nWithout proper locking, if a userdata item is added or removed\nconcurrently while these functions are iterating, the list can be\naccessed in an inconsistent state. For example, the list_for_each() loop\ncan reach a node that is being removed from the list by list_del_init()\nwhich sets the nodes' .next pointer to point to itself, so the loop will\nnever end (or reach the WARN_ON_ONCE in update_userdata() ).\n\nFix this by holding the configfs subsystem mutex (su_mutex) during all\noperations that iterate over cg_children.\nThis includes:\n- userdatum_value_store() which calls update_userdata() to iterate over\n cg_children\n- All sysdata_*_enabled_store() functions which call\n count_extradata_entries() to iterate over cg_children\n\nThe su_mutex must be acquired before dynamic_netconsole_mutex to avoid\npotential lock ordering issues, as configfs operations may already hold\nsu_mutex when calling into our code."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/netconsole.c"], "versions": [{"version": "df03f830d099f0811281a222aefdd9d400fa0b72", "lessThan": "932c0c7a7ec413399febca5fe3dddf913bb5c924", "status": "affected", "versionType": "git"}, {"version": "df03f830d099f0811281a222aefdd9d400fa0b72", "lessThan": "ff70aa7e8cf05745fdba7258952a8bedf33ea336", "status": "affected", "versionType": "git"}, {"version": "df03f830d099f0811281a222aefdd9d400fa0b72", "lessThan": "d7d2fcf7ae31471b4e08b7e448b8fd0ec2e06a1b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/netconsole.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/932c0c7a7ec413399febca5fe3dddf913bb5c924"}, {"url": "https://git.kernel.org/stable/c/ff70aa7e8cf05745fdba7258952a8bedf33ea336"}, {"url": "https://git.kernel.org/stable/c/d7d2fcf7ae31471b4e08b7e448b8fd0ec2e06a1b"}], "title": "netconsole: Acquire su_mutex before navigating configs hierarchy", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/netconsole.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "932c0c7a7ec413399febca5fe3dddf913bb5c924", "status": "affected", "version": "df03f830d099f0811281a222aefdd9d400fa0b72", "versionType": "git"}, {"lessThan": "ff70aa7e8cf05745fdba7258952a8bedf33ea336", "status": "affected", "version": "df03f830d099f0811281a222aefdd9d400fa0b72", "versionType": "git"}, {"lessThan": "d7d2fcf7ae31471b4e08b7e448b8fd0ec2e06a1b", "status": "affected", "version": "df03f830d099f0811281a222aefdd9d400fa0b72", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/netconsole.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: Acquire su_mutex before navigating configs hierarchy\n\nThere is a race between operations that iterate over the userdata\ncg_children list and concurrent add/remove of userdata items through\nconfigfs. The update_userdata() function iterates over the\nnt->userdata_group.cg_children list, and count_extradata_entries() also\niterates over this same list to count nodes.\n\nQuoting from Documentation/filesystems/configfs.rst:\n> A subsystem can navigate the cg_children list and the ci_parent pointer\n> to see the tree created by the subsystem. This can race with configfs'\n> management of the hierarchy, so configfs uses the subsystem mutex to\n> protect modifications. Whenever a subsystem wants to navigate the\n> hierarchy, it must do so under the protection of the subsystem\n> mutex.\n\nWithout proper locking, if a userdata item is added or removed\nconcurrently while these functions are iterating, the list can be\naccessed in an inconsistent state. For example, the list_for_each() loop\ncan reach a node that is being removed from the list by list_del_init()\nwhich sets the nodes' .next pointer to point to itself, so the loop will\nnever end (or reach the WARN_ON_ONCE in update_userdata() ).\n\nFix this by holding the configfs subsystem mutex (su_mutex) during all\noperations that iterate over cg_children.\nThis includes:\n- userdatum_value_store() which calls update_userdata() to iterate over\n cg_children\n- All sysdata_*_enabled_store() functions which call\n count_extradata_entries() to iterate over cg_children\n\nThe su_mutex must be acquired before dynamic_netconsole_mutex to avoid\npotential lock ordering issues, as configfs operations may already hold\nsu_mutex when calling into our code."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetconsole: Adquirir su_mutex antes de navegar por la jerarqu\u00eda de configuraciones\n\nExiste una condici\u00f3n de carrera entre las operaciones que iteran sobre la lista cg_children de userdata y la adici\u00f3n/eliminaci\u00f3n concurrente de elementos de userdata a trav\u00e9s de configfs. La funci\u00f3n update_userdata() itera sobre la lista nt -> userdata_group.cg_children, y count_extradata_entries() tambi\u00e9n itera sobre esta misma lista para contar nodos.\n\nCitando de Documentation/filesystems/configfs.rst:\n> Un subsistema puede navegar por la lista cg_children y el puntero ci_parent para ver el \u00e1rbol creado por el subsistema. Esto puede entrar en conflicto con la gesti\u00f3n de la jerarqu\u00eda por parte de configfs, por lo que configfs utiliza el mutex del subsistema para proteger las modificaciones. Siempre que un subsistema quiera navegar por la jerarqu\u00eda, debe hacerlo bajo la protecci\u00f3n del mutex del subsistema.\n\nSin un bloqueo adecuado, si un elemento de userdata es a\u00f1adido o eliminado concurrentemente mientras estas funciones est\u00e1n iterando, la lista puede ser accedida en un estado inconsistente. Por ejemplo, el bucle list_for_each() puede alcanzar un nodo que est\u00e1 siendo eliminado de la lista por list_del_init(), lo que establece el puntero .next de los nodos para que apunte a s\u00ed mismo, por lo que el bucle nunca terminar\u00e1 (o alcanzar\u00e1 el WARN_ON_ONCE en update_userdata() ).\n\nEsto se soluciona manteniendo el mutex del subsistema configfs (su_mutex) durante todas las operaciones que iteran sobre cg_children.\nEsto incluye:\n- userdatum_value_store() que llama a update_userdata() para iterar sobre cg_children\n- Todas las funciones sysdata_*_enabled_store() que llaman a count_extradata_entries() para iterar sobre cg_children\n\nEl su_mutex debe adquirirse antes que dynamic_netconsole_mutex para evitar posibles problemas de orden de bloqueo, ya que las operaciones de configfs pueden ya mantener su_mutex al llamar a nuestro c\u00f3digo."}], "id": "CVE-2025-68319", "lastModified": "2026-10-21T13:18:22.140", "metrics": {}, "published": "2025-12-16T16:16:11.483", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/932c0c7a7ec413399febca5fe3dddf913bb5c924"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d7d2fcf7ae31471b4e08b7e448b8fd0ec2e06a1b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ff70aa7e8cf05745fdba7258952a8bedf33ea336"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: netconsole: Acquire su_mutex before navigating configs hierarchy", "id": "2422818", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422818"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-68319", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68319\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68319\nhttps://lore.kernel.org/linux-cve-announce/2025121656-CVE-2025-68319-6b7f@gregkh/T"], "threat_severity": "Low"}

{}