CVE-2025-68336

Vulnerability

In the Linux kernel, the do_raw_write_lock function in the spinlock debug code contains a data race. The Kernel Concurrency Sanitizer (KCSAN) reported concurrent write and read accesses to the same memory location (0xffff800009cf504c) by different tasks. The previous fix in commit 1a365e822372 addressed most similar races but incomplete: debug_write_lock_before was not converted to use WRITE_ONCE(), leaving the race unfixed.

Exploitation

An attacker can exploit this race by triggering concurrent execution of do_raw_write_lock on multiple CPUs, for example, through parallel do_exit calls via call_usermodehelper_exec_async. No special privileges are needed beyond ability to run code that causes concurrent lock acquisition.

Impact

A successful exploit can lead to data corruption or other undefined behavior due to unsynchronized access to shared data in the lock debugging infrastructure. This could potentially be leveraged to cause system instability or privilege escalation, though specifics depend on the environment.

Mitigation

The fix is to add WRITE_ONCE() to the debug_write_lock_before part of do_raw_write_lock, making the access consistent with debug_write_lock_after. The patch has been merged into stable kernel branches. Users should update to a kernel containing the fix referenced by the commit [1].