CVE-2025-68319

Vulnerability

In the Linux kernel's netconsole subsystem, a race condition exists between operations that iterate over the userdata_group.cg_children list and concurrent addition or removal of userdata items through configfs. The functions update_userdata() and count_extradata_entries() traverse this list without holding the configfs subsystem mutex (su_mutex), violating the locking rules documented in Documentation/filesystems/configfs.rst [1]. Without proper synchronization, a concurrent add or remove can leave the list in an inconsistent state—for example, a node being removed via list_del_init() sets its .next pointer to itself, causing the list_for_each() loop to never terminate or to trigger a WARN_ON_ONCE in update_userdata().

Exploitation

An attacker with the ability to add or remove userdata items via configfs (typically requiring local access and appropriate privileges) can trigger this race. The attack surface is local; the attacker must time the configfs operation to coincide with a netconsole operation that iterates over the userdata list, such as writing to a userdatum_value sysfs file or toggling a sysdata_*_enabled attribute. No network access is required, and the attacker does not need to be authenticated to the netconsole subsystem beyond the ability to manipulate configfs entries.

Impact

Successful exploitation leads to a denial-of-service condition. The infinite loop caused by list corruption can hang the kernel thread performing the iteration, potentially causing a system lockup or crash. The description notes that the loop may never end or may reach a WARN_ON_ONCE, indicating a detectable but severe state. There is no evidence of privilege escalation or data leakage from this vulnerability alone.

Mitigation

The fix, merged into the Linux kernel stable branches, ensures that su_mutex is acquired before any operation that iterates over cg_children. The mutex is taken before dynamic_netconsole_mutex to avoid lock ordering issues, as configfs operations may already hold su_mutex when calling into netconsole code [2]. Users should apply the latest kernel updates from their distribution or compile a patched kernel. No workaround is available without the patch.