CVE-2025-68174: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68174 is a race condition vulnerability in the Linux kernel's AMD GPU driver (amdkfd) that can lead to a divide-by-zero kernel crash. The flaw exists in the partition switching logic, where the kfd_processes_table emptiness check is insufficient to prevent concurrent access between a workqueue releasing a KFD process and a partition switch tearing down KFD nodes. It was published on December 16, 2025, and affects the Linux kernel's amdgpu driver. The EPSS score is approximately 0.018% (Low), indicating limited exploitation probability at this time (Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-362) in the AMD KFD (Kernel Fusion Driver) partition switching code. When Process A (a workqueue) executes kfd_process_wq_release and accesses kfd_node members, and Process B concurrently triggers a partition switch via amdgpu_xcp_pre_partition_switch → amdgpu_amdkfd_device_fini_sw → KFD node teardown, the node can be destroyed while still in use. The existing guard only checks whether kfd_processes_table is empty, but the table entry is removed in kfd_process_notifier_release — before the actual process teardown completes in kfd_process_wq_release — leaving a window where the node is accessed after being freed. The fix introduces an atomic counter kfd_processes_count per kfd_dev that is incremented on KFD process creation and decremented only after kfd_process_wq_release completes, closing the race (Feedly).

Successful exploitation of this race condition results in a divide-by-zero kernel panic (divide error: 0000 [#1] SMP NOPTI) triggered in kfd_get_num_sdma_engines, causing a system crash and denial of service. The crash occurs in kernel context (workqueue kfd_process_wq), meaning it affects the entire host system rather than a single process. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss through a kernel crash on systems using AMD GPUs with KFD support (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-68174. The vulnerability requires local access and the ability to trigger concurrent KFD process teardown and partition switching, making it difficult to exploit reliably without specific timing conditions. The EPSS score is 0.000180 (approximately 0.018%), reflecting very low exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs: Kernel dmesg output containing divide error: 0000 [#1] SMP NOPTI with a stack trace referencing kfd_get_num_sdma_engines in the amdgpu module and workqueue kfd_process_wq kfd_process_wq_release.
• Process: Kernel crash (oops/panic) originating from kworker threads associated with kfd_process_wq on systems with AMD GPU hardware.
• System: Unexpected system reboots or kernel panics on hosts running AMD GPU workloads (e.g., ROCm/HPC environments) coinciding with GPU partition switching operations.

The fix has been merged into the Linux kernel stable tree via commits 45da20e00d5da842e17dfc633072b127504f0d0e and 536d80f660ec12058e461f4db387ea42bee9250d. Administrators should update to a patched kernel version that includes these commits. As a workaround, avoiding concurrent KFD process teardown and GPU partition switching operations can reduce exposure. Distributions including SUSE have begun shipping kernel updates addressing this issue (Feedly, Linux Security).