CVE-2025-68319
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: netconsole: Acquire su_mutex before navigating configs hierarchy There is a race between operations that iterate over the userdata cg_children list and concurrent add/remove of userdata items through configfs. The update_userdata() function iterates over the nt->userdata_group.cg_children list, and count_extradata_entries() also iterates over this same list to count nodes. Quoting from Documentation/filesystems/configfs.rst: > A subsystem can navigate the cg_children list and the ci_parent pointer > to see the tree created by the subsystem. This can race with configfs' > management of the hierarchy, so configfs uses the subsystem mutex to > protect modifications. Whenever a subsystem wants to navigate the > hierarchy, it must do so under the protection of the subsystem > mutex. Without proper locking, if a userdata item is added or removed concurrently while these functions are iterating, the list can be accessed in an inconsistent state. For example, the list_for_each() loop can reach a node that is being removed from the list by list_del_init() which sets the nodes' .next pointer to point to itself, so the loop will never end (or reach the WARN_ON_ONCE in update_userdata() ). Fix this by holding the configfs subsystem mutex (su_mutex) during all operations that iterate over cg_children. This includes: - userdatum_value_store() which calls update_userdata() to iterate over cg_children - All sysdata_*_enabled_store() functions which call count_extradata_entries() to iterate over cg_children The su_mutex must be acquired before dynamic_netconsole_mutex to avoid potential lock ordering issues, as configfs operations may already hold su_mutex when calling into our code.
View original CVE JSON
{
"id": "CVE-2025-68319",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-12-16T16:16:11.483",
"lastModified": "2026-10-21T13:18:22.140",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: Acquire su_mutex before navigating configs hierarchy\n\nThere is a race between operations that iterate over the userdata\ncg_children list and concurrent add/remove of userdata items through\nconfigfs. The update_userdata() function iterates over the\nnt->userdata_group.cg_children list, and count_extradata_entries() also\niterates over this same list to count nodes.\n\nQuoting from Documentation/filesystems/configfs.rst:\n> A subsystem can navigate the cg_children list and the ci_parent pointer\n> to see the tree created by the subsystem. This can race with configfs'\n> management of the hierarchy, so configfs uses the subsystem mutex to\n> protect modifications. Whenever a subsystem wants to navigate the\n> hierarchy, it must do so under the protection of the subsystem\n> mutex.\n\nWithout proper locking, if a userdata item is added or removed\nconcurrently while these functions are iterating, the list can be\naccessed in an inconsistent state. For example, the list_for_each() loop\ncan reach a node that is being removed from the list by list_del_init()\nwhich sets the nodes' .next pointer to point to itself, so the loop will\nnever end (or reach the WARN_ON_ONCE in update_userdata() ).\n\nFix this by holding the configfs subsystem mutex (su_mutex) during all\noperations that iterate over cg_children.\nThis includes:\n- userdatum_value_store() which calls update_userdata() to iterate over\n cg_children\n- All sysdata_*_enabled_store() functions which call\n count_extradata_entries() to iterate over cg_children\n\nThe su_mutex must be acquired before dynamic_netconsole_mutex to avoid\npotential lock ordering issues, as configfs operations may already hold\nsu_mutex when calling into our code."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetconsole: Adquirir su_mutex antes de navegar por la jerarquía de configuraciones\n\nExiste una condición de carrera entre las operaciones que iteran sobre la lista cg_children de userdata y la adición/eliminación concurrente de elementos de userdata a través de configfs. La función update_userdata() itera sobre la lista nt -> userdata_group.cg_children, y count_extradata_entries() también itera sobre esta misma lista para contar nodos.\n\nCitando de Documentation/filesystems/configfs.rst:\n> Un subsistema puede navegar por la lista cg_children y el puntero ci_parent para ver el árbol creado por el subsistema. Esto puede entrar en conflicto con la gestión de la jerarquía por parte de configfs, por lo que configfs utiliza el mutex del subsistema para proteger las modificaciones. Siempre que un subsistema quiera navegar por la jerarquía, debe hacerlo bajo la protección del mutex del subsistema.\n\nSin un bloqueo adecuado, si un elemento de userdata es añadido o eliminado concurrentemente mientras estas funciones están iterando, la lista puede ser accedida en un estado inconsistente. Por ejemplo, el bucle list_for_each() puede alcanzar un nodo que está siendo eliminado de la lista por list_del_init(), lo que establece el puntero .next de los nodos para que apunte a sí mismo, por lo que el bucle nunca terminará (o alcanzará el WARN_ON_ONCE en update_userdata() ).\n\nEsto se soluciona manteniendo el mutex del subsistema configfs (su_mutex) durante todas las operaciones que iteran sobre cg_children.\nEsto incluye:\n- userdatum_value_store() que llama a update_userdata() para iterar sobre cg_children\n- Todas las funciones sysdata_*_enabled_store() que llaman a count_extradata_entries() para iterar sobre cg_children\n\nEl su_mutex debe adquirirse antes que dynamic_netconsole_mutex para evitar posibles problemas de orden de bloqueo, ya que las operaciones de configfs pueden ya mantener su_mutex al llamar a nuestro código."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/netconsole.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "df03f830d099f0811281a222aefdd9d400fa0b72",
"lessThan": "932c0c7a7ec413399febca5fe3dddf913bb5c924",
"versionType": "git",
"status": "affected"
},
{
"version": "df03f830d099f0811281a222aefdd9d400fa0b72",
"lessThan": "ff70aa7e8cf05745fdba7258952a8bedf33ea336",
"versionType": "git",
"status": "affected"
},
{
"version": "df03f830d099f0811281a222aefdd9d400fa0b72",
"lessThan": "d7d2fcf7ae31471b4e08b7e448b8fd0ec2e06a1b",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/netconsole.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.9",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.9",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.114",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.8",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/932c0c7a7ec413399febca5fe3dddf913bb5c924",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d7d2fcf7ae31471b4e08b7e448b8fd0ec2e06a1b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ff70aa7e8cf05745fdba7258952a8bedf33ea336",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}