CVE-2025-68168: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68168 is a Linux kernel vulnerability in the JFS (Journaled File System) transaction manager caused by an uninitialized waitqueue in txInit(). Specifically, TxBlock[0].waitor was never initialized because the initialization loop started at index 1 instead of 0, leading to a kernel crash when txEnd(0) is called on read-only filesystems. The vulnerability was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. The EPSS score is approximately 0.024% (very low), and no CVSS base score has been formally assigned (Feedly, EUVD).

The root cause is an improper initialization defect (CWE-909: Missing Initialization of Resource) in the JFS transaction manager's txInit() function. When a filesystem is mounted read-only, txBegin() returns tid=0 to signal no active transaction; however, txEnd(0) is still invoked and attempts to access TxBlock[0].waitor via tid_to_tblock(0). Because the initialization loop began at index 1, TxBlock[0]'s waitqueue was left uninitialized, triggering a lockdep 'non-static key' warning and a subsequent system crash (INFO: trying to register non-static key in txEnd). The fix ensures the initialization loop starts at index 0, covering all transaction blocks including TxBlock[0] (Feedly).

Successful triggering of this vulnerability causes a kernel crash (denial of service) on systems using the JFS filesystem mounted in read-only mode. The primary impact is availability — an attacker or unprivileged local user who can mount or interact with a JFS read-only filesystem may be able to crash the kernel. There is no known confidentiality or integrity impact, and lateral movement potential is limited to the local system (Feedly).

• Logs: Kernel log messages containing INFO: trying to register non-static key in txEnd or lockdep warnings related to TxBlock[0].waitor in /var/log/kern.log or dmesg output.
• System Behavior: Unexpected kernel panic or system crash on hosts using JFS filesystems mounted read-only, particularly during filesystem unmount or transaction end operations.

Patches have been backported to multiple stable Linux kernel branches. Updated versions include: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18. Debian LTS users should apply the update referenced in DLA-4436-1, and Ubuntu users should apply USN-8096-1, USN-8096-2, USN-8096-3, and USN-8116-1 as applicable. As a workaround, avoiding the use of JFS filesystems mounted read-only on unpatched systems reduces exposure (Debian LTS, Ubuntu USN-8096-1, Feedly).