GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68320 (GCVE-0-2025-68320)

Vulnerability from cvelistv5 – Published: 2025-12-16 15:44 – Updated: 2026-08-05 12:10
VLAI
Title
lan966x: Fix sleeping in atomic context
Summary
In the Linux kernel, the following vulnerability has been resolved: lan966x: Fix sleeping in atomic context The following warning was seen when we try to connect using ssh to the device. BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 104, name: dropbear preempt_count: 1, expected: 0 INFO: lockdep is turned off. CPU: 0 UID: 0 PID: 104 Comm: dropbear Tainted: G W 6.18.0-rc2-00399-g6f1ab1b109b9-dirty #530 NONE Tainted: [W]=WARN Hardware name: Generic DT based system Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __might_resched+0x16c/0x2b0 __might_resched from __mutex_lock+0x64/0xd34 __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from lan966x_stats_get+0x5c/0x558 lan966x_stats_get from dev_get_stats+0x40/0x43c dev_get_stats from dev_seq_printf_stats+0x3c/0x184 dev_seq_printf_stats from dev_seq_show+0x10/0x30 dev_seq_show from seq_read_iter+0x350/0x4ec seq_read_iter from seq_read+0xfc/0x194 seq_read from proc_reg_read+0xac/0x100 proc_reg_read from vfs_read+0xb0/0x2b0 vfs_read from ksys_read+0x6c/0xec ksys_read from ret_fast_syscall+0x0/0x1c Exception stack(0xf0b11fa8 to 0xf0b11ff0) 1fa0: 00000001 00001000 00000008 be9048d8 00001000 00000001 1fc0: 00000001 00001000 00000008 00000003 be905920 0000001e 00000000 00000001 1fe0: 0005404c be9048c0 00018684 b6ec2cd8 It seems that we are using a mutex in a atomic context which is wrong. Change the mutex with a spinlock.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007 , < 5a5d2f7727752b64d13263eacd9f8d08a322e662 (git)
Affected: 12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007 , < c8ab03aa5bd9fd8bfe5d9552d8605826759fdd4d (git)
Affected: 12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007 , < 3ac743c60ec502163c435712d527eeced8d83348 (git)
Affected: 12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007 , < 0216721ce71252f60d89af49c8dff613358058d3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.6.117 , ≤ 6.6.* (semver)
Unaffected: 6.12.58 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c",
            "drivers/net/ethernet/microchip/lan966x/lan966x_main.c",
            "drivers/net/ethernet/microchip/lan966x/lan966x_main.h",
            "drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5a5d2f7727752b64d13263eacd9f8d08a322e662",
              "status": "affected",
              "version": "12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007",
              "versionType": "git"
            },
            {
              "lessThan": "c8ab03aa5bd9fd8bfe5d9552d8605826759fdd4d",
              "status": "affected",
              "version": "12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007",
              "versionType": "git"
            },
            {
              "lessThan": "3ac743c60ec502163c435712d527eeced8d83348",
              "status": "affected",
              "version": "12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007",
              "versionType": "git"
            },
            {
              "lessThan": "0216721ce71252f60d89af49c8dff613358058d3",
              "status": "affected",
              "version": "12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c",
            "drivers/net/ethernet/microchip/lan966x/lan966x_main.c",
            "drivers/net/ethernet/microchip/lan966x/lan966x_main.h",
            "drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlan966x: Fix sleeping in atomic context\n\nThe following warning was seen when we try to connect using ssh to the device.\n\nBUG: sleeping function called from invalid context at kernel/locking/mutex.c:575\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 104, name: dropbear\npreempt_count: 1, expected: 0\nINFO: lockdep is turned off.\nCPU: 0 UID: 0 PID: 104 Comm: dropbear Tainted: G        W           6.18.0-rc2-00399-g6f1ab1b109b9-dirty #530 NONE\nTainted: [W]=WARN\nHardware name: Generic DT based system\nCall trace:\n unwind_backtrace from show_stack+0x10/0x14\n show_stack from dump_stack_lvl+0x7c/0xac\n dump_stack_lvl from __might_resched+0x16c/0x2b0\n __might_resched from __mutex_lock+0x64/0xd34\n __mutex_lock from mutex_lock_nested+0x1c/0x24\n mutex_lock_nested from lan966x_stats_get+0x5c/0x558\n lan966x_stats_get from dev_get_stats+0x40/0x43c\n dev_get_stats from dev_seq_printf_stats+0x3c/0x184\n dev_seq_printf_stats from dev_seq_show+0x10/0x30\n dev_seq_show from seq_read_iter+0x350/0x4ec\n seq_read_iter from seq_read+0xfc/0x194\n seq_read from proc_reg_read+0xac/0x100\n proc_reg_read from vfs_read+0xb0/0x2b0\n vfs_read from ksys_read+0x6c/0xec\n ksys_read from ret_fast_syscall+0x0/0x1c\nException stack(0xf0b11fa8 to 0xf0b11ff0)\n1fa0:                   00000001 00001000 00000008 be9048d8 00001000 00000001\n1fc0: 00000001 00001000 00000008 00000003 be905920 0000001e 00000000 00000001\n1fe0: 0005404c be9048c0 00018684 b6ec2cd8\n\nIt seems that we are using a mutex in a atomic context which is wrong.\nChange the mutex with a spinlock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An unauthenticated TCP connection to Dropbear reaches the flaw because its accept loop reads /proc/net/dev before forking or authentication. This is the network-facing embedded deployment documented by the fix.\nAC:L - Each accepted connection deterministically triggers the statistics read, and repeated connections can intersect the driver\u0027s periodic statistics-lock hold. No race condition outside the attacker\u0027s practical influence is required.\nPR:N - The vulnerable read occurs before SSH authentication, so no service credentials, local account, or kernel capability are required.\nUI:N - Once the network service is running, the attacker can trigger the flaw without any victim action.\nS:U - The resulting failure remains within the host kernel\u0027s security authority and does not cross a virtualization, sandbox, or IOMMU boundary.\nC:N - The affected code reads in-bounds cached counters and provides no attacker-visible kernel-memory disclosure or arbitrary-read primitive.\nI:N - The flaw provides no attacker-controlled memory write, data modification, or control-flow primitive.\nA:H - A contended mutex can force scheduling while RCU or preemption is disabled, causing scheduling-state corruption and a potential kernel panic or hang. Repeated pre-authentication connections can drive this condition."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:10:52.102Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5a5d2f7727752b64d13263eacd9f8d08a322e662"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8ab03aa5bd9fd8bfe5d9552d8605826759fdd4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ac743c60ec502163c435712d527eeced8d83348"
        },
        {
          "url": "https://git.kernel.org/stable/c/0216721ce71252f60d89af49c8dff613358058d3"
        }
      ],
      "title": "lan966x: Fix sleeping in atomic context",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68320",
    "datePublished": "2025-12-16T15:44:18.217Z",
    "dateReserved": "2025-12-16T14:48:05.295Z",
    "dateUpdated": "2026-08-05T12:10:52.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68320",
      "date": "2026-09-16",
      "epss": "0.00414",
      "percentile": "0.35179"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68320\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T16:16:11.587\",\"lastModified\":\"2026-07-30T06:24:38.240\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlan966x: Fix sleeping in atomic context\\n\\nThe following warning was seen when we try to connect using ssh to the device.\\n\\nBUG: sleeping function called from invalid context at kernel/locking/mutex.c:575\\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 104, name: dropbear\\npreempt_count: 1, expected: 0\\nINFO: lockdep is turned off.\\nCPU: 0 UID: 0 PID: 104 Comm: dropbear Tainted: G        W           6.18.0-rc2-00399-g6f1ab1b109b9-dirty #530 NONE\\nTainted: [W]=WARN\\nHardware name: Generic DT based system\\nCall trace:\\n unwind_backtrace from show_stack+0x10/0x14\\n show_stack from dump_stack_lvl+0x7c/0xac\\n dump_stack_lvl from __might_resched+0x16c/0x2b0\\n __might_resched from __mutex_lock+0x64/0xd34\\n __mutex_lock from mutex_lock_nested+0x1c/0x24\\n mutex_lock_nested from lan966x_stats_get+0x5c/0x558\\n lan966x_stats_get from dev_get_stats+0x40/0x43c\\n dev_get_stats from dev_seq_printf_stats+0x3c/0x184\\n dev_seq_printf_stats from dev_seq_show+0x10/0x30\\n dev_seq_show from seq_read_iter+0x350/0x4ec\\n seq_read_iter from seq_read+0xfc/0x194\\n seq_read from proc_reg_read+0xac/0x100\\n proc_reg_read from vfs_read+0xb0/0x2b0\\n vfs_read from ksys_read+0x6c/0xec\\n ksys_read from ret_fast_syscall+0x0/0x1c\\nException stack(0xf0b11fa8 to 0xf0b11ff0)\\n1fa0:                   00000001 00001000 00000008 be9048d8 00001000 00000001\\n1fc0: 00000001 00001000 00000008 00000003 be905920 0000001e 00000000 00000001\\n1fe0: 0005404c be9048c0 00018684 b6ec2cd8\\n\\nIt seems that we are using a mutex in a atomic context which is wrong.\\nChange the mutex with a spinlock.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c\",\"drivers/net/ethernet/microchip/lan966x/lan966x_main.c\",\"drivers/net/ethernet/microchip/lan966x/lan966x_main.h\",\"drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007\",\"lessThan\":\"5a5d2f7727752b64d13263eacd9f8d08a322e662\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007\",\"lessThan\":\"c8ab03aa5bd9fd8bfe5d9552d8605826759fdd4d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007\",\"lessThan\":\"3ac743c60ec502163c435712d527eeced8d83348\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12c2d0a5b8e2a1afc8c7738e19a0d1dd7f3d4007\",\"lessThan\":\"0216721ce71252f60d89af49c8dff613358058d3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c\",\"drivers/net/ethernet/microchip/lan966x/lan966x_main.c\",\"drivers/net/ethernet/microchip/lan966x/lan966x_main.h\",\"drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.117\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.58\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.8\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0216721ce71252f60d89af49c8dff613358058d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3ac743c60ec502163c435712d527eeced8d83348\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5a5d2f7727752b64d13263eacd9f8d08a322e662\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c8ab03aa5bd9fd8bfe5d9552d8605826759fdd4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T17:54:33+00:00",
      "cve": "CVE-2025-68320",
      "id": "CVE-2025-68320",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (lan966x): Denial of Service via incorrect mutex usage",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68320.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:44:40Z",
      "cve": "CVE-2025-68320",
      "id": "CVE-2025-68320",
      "initial_release_date": "2025-12-17T00:23:40Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "482",
      "product_status:known_not_affected": "388",
      "product_status:recommended": "289",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68320",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68320.json",
      "version": "35"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.