CVE-2025-68169 (GCVE-0-2025-68169)
Vulnerability from cvelistv5
Published
2025-12-16 13:42
Modified
2025-12-16 13:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netpoll: Fix deadlock in memory allocation under spinlock
Fix a AA deadlock in refill_skbs() where memory allocation while holding
skb_pool->lock can trigger a recursive lock acquisition attempt.
The deadlock scenario occurs when the system is under severe memory
pressure:
1. refill_skbs() acquires skb_pool->lock (spinlock)
2. alloc_skb() is called while holding the lock
3. Memory allocator fails and calls slab_out_of_memory()
4. This triggers printk() for the OOM warning
5. The console output path calls netpoll_send_udp()
6. netpoll_send_udp() attempts to acquire the same skb_pool->lock
7. Deadlock: the lock is already held by the same CPU
Call stack:
refill_skbs()
spin_lock_irqsave(&skb_pool->lock) <- lock acquired
__alloc_skb()
kmem_cache_alloc_node_noprof()
slab_out_of_memory()
printk()
console_flush_all()
netpoll_send_udp()
skb_dequeue()
spin_lock_irqsave(&skb_pool->lock) <- deadlock attempt
This bug was exposed by commit 248f6571fd4c51 ("netpoll: Optimize skb
refilling on critical path") which removed refill_skbs() from the
critical path (where nested printk was being deferred), letting nested
printk being called from inside refill_skbs()
Refactor refill_skbs() to never allocate memory while holding
the spinlock.
Another possible solution to fix this problem is protecting the
refill_skbs() from nested printks, basically calling
printk_deferred_{enter,exit}() in refill_skbs(), then, any nested
pr_warn() would be deferred.
I prefer this approach, given I _think_ it might be a good idea to move
the alloc_skb() from GFP_ATOMIC to GFP_KERNEL in the future, so, having
the alloc_skb() outside of the lock will be necessary step.
There is a possible TOCTOU issue when checking for the pool length, and
queueing the new allocated skb, but, this is not an issue, given that
an extra SKB in the pool is harmless and it will be eventually used.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/netpoll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06742a3ab884d7428c9050b205ffcf6a8a548397",
"status": "affected",
"version": "248f6571fd4c51531f7f8f07f186f7ae98a50afc",
"versionType": "git"
},
{
"lessThan": "327c20c21d80e0d87834b392d83ae73c955ad8ff",
"status": "affected",
"version": "248f6571fd4c51531f7f8f07f186f7ae98a50afc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/netpoll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.8",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetpoll: Fix deadlock in memory allocation under spinlock\n\nFix a AA deadlock in refill_skbs() where memory allocation while holding\nskb_pool-\u003elock can trigger a recursive lock acquisition attempt.\n\nThe deadlock scenario occurs when the system is under severe memory\npressure:\n\n1. refill_skbs() acquires skb_pool-\u003elock (spinlock)\n2. alloc_skb() is called while holding the lock\n3. Memory allocator fails and calls slab_out_of_memory()\n4. This triggers printk() for the OOM warning\n5. The console output path calls netpoll_send_udp()\n6. netpoll_send_udp() attempts to acquire the same skb_pool-\u003elock\n7. Deadlock: the lock is already held by the same CPU\n\nCall stack:\n refill_skbs()\n spin_lock_irqsave(\u0026skb_pool-\u003elock) \u003c- lock acquired\n __alloc_skb()\n kmem_cache_alloc_node_noprof()\n slab_out_of_memory()\n printk()\n console_flush_all()\n netpoll_send_udp()\n skb_dequeue()\n spin_lock_irqsave(\u0026skb_pool-\u003elock) \u003c- deadlock attempt\n\nThis bug was exposed by commit 248f6571fd4c51 (\"netpoll: Optimize skb\nrefilling on critical path\") which removed refill_skbs() from the\ncritical path (where nested printk was being deferred), letting nested\nprintk being called from inside refill_skbs()\n\nRefactor refill_skbs() to never allocate memory while holding\nthe spinlock.\n\nAnother possible solution to fix this problem is protecting the\nrefill_skbs() from nested printks, basically calling\nprintk_deferred_{enter,exit}() in refill_skbs(), then, any nested\npr_warn() would be deferred.\n\nI prefer this approach, given I _think_ it might be a good idea to move\nthe alloc_skb() from GFP_ATOMIC to GFP_KERNEL in the future, so, having\nthe alloc_skb() outside of the lock will be necessary step.\n\nThere is a possible TOCTOU issue when checking for the pool length, and\nqueueing the new allocated skb, but, this is not an issue, given that\nan extra SKB in the pool is harmless and it will be eventually used."
}
],
"providerMetadata": {
"dateUpdated": "2025-12-16T13:42:49.270Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06742a3ab884d7428c9050b205ffcf6a8a548397"
},
{
"url": "https://git.kernel.org/stable/c/327c20c21d80e0d87834b392d83ae73c955ad8ff"
}
],
"title": "netpoll: Fix deadlock in memory allocation under spinlock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68169",
"datePublished": "2025-12-16T13:42:49.270Z",
"dateReserved": "2025-12-16T13:41:40.250Z",
"dateUpdated": "2025-12-16T13:42:49.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-68169\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T14:15:48.760\",\"lastModified\":\"2025-12-18T15:08:25.907\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetpoll: Fix deadlock in memory allocation under spinlock\\n\\nFix a AA deadlock in refill_skbs() where memory allocation while holding\\nskb_pool-\u003elock can trigger a recursive lock acquisition attempt.\\n\\nThe deadlock scenario occurs when the system is under severe memory\\npressure:\\n\\n1. refill_skbs() acquires skb_pool-\u003elock (spinlock)\\n2. alloc_skb() is called while holding the lock\\n3. Memory allocator fails and calls slab_out_of_memory()\\n4. This triggers printk() for the OOM warning\\n5. The console output path calls netpoll_send_udp()\\n6. netpoll_send_udp() attempts to acquire the same skb_pool-\u003elock\\n7. Deadlock: the lock is already held by the same CPU\\n\\nCall stack:\\n refill_skbs()\\n spin_lock_irqsave(\u0026skb_pool-\u003elock) \u003c- lock acquired\\n __alloc_skb()\\n kmem_cache_alloc_node_noprof()\\n slab_out_of_memory()\\n printk()\\n console_flush_all()\\n netpoll_send_udp()\\n skb_dequeue()\\n spin_lock_irqsave(\u0026skb_pool-\u003elock) \u003c- deadlock attempt\\n\\nThis bug was exposed by commit 248f6571fd4c51 (\\\"netpoll: Optimize skb\\nrefilling on critical path\\\") which removed refill_skbs() from the\\ncritical path (where nested printk was being deferred), letting nested\\nprintk being called from inside refill_skbs()\\n\\nRefactor refill_skbs() to never allocate memory while holding\\nthe spinlock.\\n\\nAnother possible solution to fix this problem is protecting the\\nrefill_skbs() from nested printks, basically calling\\nprintk_deferred_{enter,exit}() in refill_skbs(), then, any nested\\npr_warn() would be deferred.\\n\\nI prefer this approach, given I _think_ it might be a good idea to move\\nthe alloc_skb() from GFP_ATOMIC to GFP_KERNEL in the future, so, having\\nthe alloc_skb() outside of the lock will be necessary step.\\n\\nThere is a possible TOCTOU issue when checking for the pool length, and\\nqueueing the new allocated skb, but, this is not an issue, given that\\nan extra SKB in the pool is harmless and it will be eventually used.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06742a3ab884d7428c9050b205ffcf6a8a548397\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/327c20c21d80e0d87834b392d83ae73c955ad8ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…