CVE-2025-68168: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68168 is a Linux kernel vulnerability in the JFS (Journaled File System) transaction manager caused by an uninitialized waitqueue in txInit(). Specifically, TxBlock[0].waitor was never initialized because the initialization loop started at index 1 instead of 0, leading to a kernel crash when txEnd(0) is called on read-only filesystems. The vulnerability was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. The EPSS score is approximately 0.024% (very low), and no CVSS base score has been formally assigned (Feedly, EUVD).

The root cause is an improper initialization defect (CWE-909: Missing Initialization of Resource) in the JFS transaction manager's txInit() function. When a filesystem is mounted read-only, txBegin() returns tid=0 to signal no active transaction; however, txEnd(0) is still invoked and attempts to access TxBlock[0].waitor via tid_to_tblock(0). Because the initialization loop began at index 1, TxBlock[0]'s waitqueue was left uninitialized, triggering a lockdep 'non-static key' warning and a subsequent system crash (INFO: trying to register non-static key in txEnd). The fix ensures the initialization loop starts at index 0, covering all transaction blocks including TxBlock[0] (Feedly).

Successful triggering of this vulnerability causes a kernel crash (denial of service) on systems using the JFS filesystem mounted in read-only mode. The primary impact is availability — an attacker or unprivileged local user who can mount or interact with a JFS read-only filesystem may be able to crash the kernel. There is no known confidentiality or integrity impact, and lateral movement potential is limited to the local system (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68168. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

• Logs: Kernel log messages containing INFO: trying to register non-static key in txEnd or lockdep warnings related to TxBlock[0].waitor in /var/log/kern.log or dmesg output.
• System Behavior: Unexpected kernel panic or system crash on hosts using JFS filesystems mounted read-only, particularly during filesystem unmount or transaction end operations.

Patches have been backported to multiple stable Linux kernel branches. Updated versions include: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18. Debian LTS users should apply the update referenced in DLA-4436-1, and Ubuntu users should apply USN-8096-1, USN-8096-2, USN-8096-3, and USN-8116-1 as applicable. As a workaround, avoiding the use of JFS filesystems mounted read-only on unpatched systems reduces exposure (Debian LTS, Ubuntu USN-8096-1, Feedly).