Look up another CVE · open CVE-2025-68320 in the interactive tracker
CVE-2025-68320
lan966x: Fix sleeping in atomic context
Published 2025-12-16 (10 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2025-68320 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.63-1 | Update the kernel and reboot. Fixed in 6.12.63-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.17.8-1 | Update the kernel and reboot. Fixed in 6.17.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.17.8-1 | Update the kernel and reboot. Fixed in 6.17.8-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The following warning was seen when we try to connect using ssh to the device. BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 104, name: dropbear preempt_count: 1, expected: 0 INFO: lockdep is turned off. CPU: 0 UID: 0 PID: 104 Comm: dropbear Tainted: G W 6.18.0-rc2-00399-g6f1ab1b109b9-dirty #530 NONE Tainted: [W]=WARN Hardware name: Generic DT based system Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __might_resched+0x16c/0x2b0 __might_resched from __mutex_lock+0x64/0xd34 __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from lan966x_stats_get+0x5c/0x558 lan966x_stats_get from dev_get_stats+0x40/0x43c dev_get_stats from dev_seq_printf_stats+0x3c/0x184 dev_seq_printf_stats from dev_seq_show+0x10/0x30 dev_seq_show from seq_read_iter+0x350/0x4ec seq_read_iter from seq_read+0xfc/0x194 seq_read from proc_reg_read+0xac/0x100 proc_reg_read from vfs_read+0xb0/0x2b0 vfs_read from ksys_read+0x6c/0xec ksys_read from ret_fast_syscall+0x0/0x1c Exception stack(0xf0b11fa8 to 0xf0b11ff0) 1fa0: 00000001 00001000 00000008 be9048d8 00001000 00000001 1fc0: 00000001 00001000 00000008 00000003 be905920 0000001e 00000000 00000001 1fe0: 0005404c be9048c0 00018684 b6ec2cd8 It seems that we are using a mutex in a atomic context which is wrong. Change the mutex with a spinlock.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c
drivers/net/ethernet/microchip/lan966x/lan966x_main.c
drivers/net/ethernet/microchip/lan966x/lan966x_main.h
drivers/net/ethernet/microchip/lan966x/lan966x_vcap_impl.c
- What this is
- MICROCHIP LAN966X ETHERNET DRIVERMAINTAINERS section matched on drivers/net/ethernet/microchip/lan966x/* · netdev@vger.kernel.org · Maintained
- Kernel module
- none to look for. The file would have gone into lan966x_switch, and Debian does not compile it into that module, so finding lan966x_switch in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_ETHERNET|CONFIG_LAN966X_SWITCH|CONFIG_NET_VENDOR_MICROCHIP' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_ETHERNET, CONFIG_LAN966X_SWITCH, CONFIG_NET_VENDOR_MICROCHIP
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2025-12-16 (10 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.41%, higher than 34.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.17 | 6.6.117 | 5a5d2f772775 |
| 5.17 | 6.12.58 | c8ab03aa5bd9 |
| 5.17 | 6.17.8 | 3ac743c60ec5 |
| 5.17 | 6.18 | 0216721ce712 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- An unauthenticated TCP connection to Dropbear reaches the flaw because its accept loop reads /proc/net/dev before forking or authentication. This is the network-facing embedded deployment documented by the fix.
- AC:LAttack complexity, low
- Each accepted connection deterministically triggers the statistics read, and repeated connections can intersect the driver's periodic statistics-lock hold. No race condition outside the attacker's practical influence is required.
- PR:NPrivileges required, none
- The vulnerable read occurs before SSH authentication, so no service credentials, local account, or kernel capability are required.
- UI:NUser interaction, none
- Once the network service is running, the attacker can trigger the flaw without any victim action.
- S:UScope, unchanged
- The resulting failure remains within the host kernel's security authority and does not cross a virtualization, sandbox, or IOMMU boundary.
- C:NConfidentiality impact, none
- The affected code reads in-bounds cached counters and provides no attacker-visible kernel-memory disclosure or arbitrary-read primitive.
- I:NIntegrity impact, none
- The flaw provides no attacker-controlled memory write, data modification, or control-flow primitive.
- A:HAvailability impact, high
- A contended mutex can force scheduling while RCU or preemption is disabled, causing scheduling-state corruption and a potential kernel panic or hang. Repeated pre-authentication connections can drive this condition.