CVE-2025-68253

Vulnerability

In the Linux kernel, the add_stack_record_to_list() function in mm/page_owner.c could spin indefinitely when called from a context that does not allow sleeping or spinning, such as *_nolock() allocator paths. This occurs because inc_stack_record_count() invokes add_stack_record_to_list() which tries to acquire a spinlock without checking whether the current context permits blocking, leading to potential deadlocks or hangs [1].

Exploitation

The vulnerability is triggered during page allocation when __set_page_owner() is called from post_alloc_hook(), which itself is invoked via the alloc_pages_nolock_noprof() path. An attacker would need to be able to trigger memory allocation in such a way that the page allocation occurs from an atomic or non-sleepable context, potentially through crafted system calls or by exploiting other subsystems that lead to this code path [1].

Impact

If exploited, an attacker could cause a denial-of-service condition by causing the kernel to hang or deadlock, as the spinlock acquisition in add_stack_record_to_list() will never succeed if the lock is held and the context cannot wait. This can result in system unresponsiveness or crash [1].

Mitigation

The fix, included in Linux kernel stable commits, ensures that add_stack_record_to_list() does not spin when the GFP flags indicate that sleeping or spinning is not allowed. Users should apply the latest kernel updates from their distribution or the mainline kernel to address this issue [1].