CVE-2025-68185: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68185 is a race condition vulnerability in the Linux kernel's NFSv4 subsystem, specifically in the nfs4_setup_readdir() function, caused by insufficient locking when dereferencing ->d_parent->d_inode. The flaw was disclosed on December 16, 2025, and affects the Linux kernel across a wide range of stable branches. Fixed versions include 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18. The CVSS base score is listed as 0.0 (no severity rating assigned at time of publication), and the EPSS score is approximately 0.024% (Feedly, ENISA EUVD).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-362) in the nfs4_setup_readdir() function within the Linux kernel's NFS client implementation. The function dereferences ->d_parent->d_inode without holding the appropriate ->d_lock, creating a theoretical window where a concurrent operation could modify the dentry parent pointer, potentially leading to a kernel oops (NULL pointer dereference or use-after-free). The fix places the xdr_encode_hyper() call — which internally calls put_unaligned_be64() — under ->d_lock to ensure safe access. The kernel developers noted this race is theoretically triggerable but practically very difficult to hit on real hardware; it may be more feasible in a KVM environment (Feedly).

Successful exploitation could cause a kernel panic (oops) on affected Linux systems, resulting in a denial of service. Because the vulnerability resides in kernel space within the NFS client subsystem, a triggered race could lead to system instability or crash, impacting availability. Confidentiality and integrity impacts are considered minimal given the nature of the race condition and the difficulty of reliable exploitation (Feedly, ENISA EUVD).

The Linux kernel project has released patches across all affected stable branches. Users should update to the following fixed versions or later: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, or 6.18. Major distributions including Ubuntu (USN-8096-1/2/3/5), Debian (DLA-4436-1), SUSE (SUSE-SU-2026:2068-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2025-096, ALAS2KERNEL-5.10-2026-112), and Oracle Linux have issued corresponding advisories. No configuration-based workaround is available; patching is the only remediation (Ubuntu Advisory, Debian LTS, SUSE Advisory, Amazon Linux).