CVE-2025-68320

Vulnerability

Details

The lan966x Ethernet switch driver in the Linux kernel uses a mutex (lan966x->stats_lock) inside the lan966x_stats_get function. However, this function can be invoked in atomic context — for example, when proc_reg_read triggers dev_seq_show, which ultimately calls dev_get_stats and then lan966x_stats_get. The kernel bug warning shows a call trace originating from dropbear reading procfs stats, with preempt_count: 1 indicating atomicity [1][2]. This violates the rule that sleeping functions (like mutex_lock) must not be used in atomic context.

Exploitation

Path

An attacker with local shell access on the affected device can trigger the bug by simply reading statistics through procfs (e.g., cat /proc/net/dev). No special privileges beyond initiating a procfs read are required — the bug manifests during normal operation when an SSH daemon (like dropbear) reads network interface stats. The attack surface is low; it does not require network-based exploitation but relies on local access to the system.

Impact

When the mutex is acquired in atomic context, the kernel throws a BUG: sleeping function called from invalid context warning and may cause a kernel panic or hang. This results in a denial-of-service (DoS) condition, potentially crashing the system or making it unresponsive. The attacker can achieve local denial of service without needing elevated permissions.

Mitigation

The fix replaces the mutex with a spinlock, which is safe to use in atomic context. The patches have been applied to the Linux kernel stable tree [1][2][3][4]. Users should update their kernel to a version containing the commit that replaces mutex_lock with spin_lock in lan966x_stats_get.