CVE-2025-68173: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68173 is a Linux kernel vulnerability in the ftrace_module_enable function that causes a soft lockup (kernel panic) when loading modules with a large number of traceable functions, such as the amdgpu module. The issue arises because multiple calls to kallsyms_lookup within an RCU critical section with preemption disabled can consume excessive CPU time, triggering a soft lockup watchdog. It was published on December 16, 2025, and affects the Linux kernel across a wide range of versions. Fixed versions include Linux 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18. No CVSS score has been assigned by the ENISA/NVD entry (base score 0.0), indicating it is primarily a denial-of-service/stability issue rather than a security exploit (Feedly, ENISA EUVD).

The root cause is a missing scheduler yield point (cond_resched()) in the ftrace_module_enable function within the Linux kernel's function tracer (ftrace) subsystem, classifiable under CWE-400 (Uncontrolled Resource Consumption). When a module with many traceable functions (e.g., amdgpu) is loaded, the function iterates through all traceable functions calling kallsyms_lookup repeatedly while holding an RCU read lock with preemption disabled; this loop can run long enough to trigger the soft lockup watchdog and cause a kernel panic. The fix mirrors prior resolutions in commits d0b24b4e91fc ("ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY kernels") and 42ea22e754ba ("ftrace: Add cond_resched() to ftrace_graph_set_hash()"), by inserting a cond_resched() call to allow the scheduler to run between iterations (Feedly).

The primary impact is a denial of service: affected systems can experience a kernel soft lockup and panic when loading modules with a large number of traceable functions, resulting in a complete system crash and loss of availability. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution. Systems running workloads that dynamically load large kernel modules (e.g., GPU drivers like amdgpu) are most at risk (Feedly, ENISA EUVD).

Apply the upstream kernel patches that introduce cond_resched() into ftrace_module_enable. Fixed stable kernel versions are 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18. Linux distribution users should apply vendor-supplied kernel updates; Debian LTS users can refer to DLA-4436-1 for the 6.1 series fix (Debian LTS). As a temporary workaround, avoiding dynamic loading of large kernel modules (e.g., amdgpu) on affected kernel versions can prevent triggering the lockup, though upgrading to a patched kernel is the recommended solution.