CVE-2025-68169: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68169 is a deadlock vulnerability in the Linux kernel's netpoll subsystem, specifically within the refill_skbs() function. The flaw allows a recursive spinlock acquisition attempt under severe memory pressure, leading to a system hang (AA deadlock). It was published on December 16, 2025, and affects the Linux kernel. The CVSS score has not been formally assigned at this time, and the CVE status is listed as Unknown (Feedly, CVE.org).

The root cause is a lock ordering/reentrancy issue (CWE-667: Improper Locking) in refill_skbs(). When the function holds skb_pool->lock (a spinlock) and calls alloc_skb(), a memory allocation failure under pressure can trigger slab_out_of_memory(), which calls printk(). The console output path then invokes netpoll_send_udp(), which attempts to re-acquire the same skb_pool->lock on the same CPU, causing a deadlock. This regression was introduced by commit 248f6571fd4c51 ("netpoll: Optimize skb refilling on critical path"), which removed refill_skbs() from the critical path where nested printk calls were previously deferred. The fix refactors refill_skbs() to never allocate memory while holding the spinlock (Feedly, kernel.org patch 1, kernel.org patch 2).

Successful triggering of this vulnerability causes a complete system hang (deadlock) on the affected CPU, resulting in a denial of service. Because the deadlock occurs within a spinlock context with interrupts disabled, the system cannot recover without a hard reset. There is no known confidentiality or integrity impact; the primary consequence is availability loss (Feedly).

Apply the upstream Linux kernel patches that refactor refill_skbs() to avoid memory allocation while holding skb_pool->lock. The fixes are available in the stable kernel tree at commits 327c20c21d80 and 06742a3ab884. Linux distribution vendors (e.g., Red Hat) are tracking this issue and are expected to release updated kernel packages; users should apply vendor-provided kernel updates as they become available (Feedly, Tenable).