CVE-2025-68202: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68202 is a locking correctness vulnerability in the Linux kernel's sched_ext subsystem, specifically in the scx_dump_state() function. On kernels built with CONFIG_PREEMPT_RT=y, the dump_lock is converted to a sleepable spinlock that does not disable IRQs, creating an inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} locking scenario that can lead to unsafe locking conditions. The vulnerability was published on December 16, 2025, and affects the Linux kernel. Feedly estimates the severity as Medium, with an EPSS score of 0.017% (Feedly).

The root cause is improper locking behavior (CWE-667: Improper Locking) in scx_dump_state() within the Linux kernel's extensible scheduler (sched_ext) subsystem. When CONFIG_PREEMPT_RT=y is enabled, spinlocks become sleepable and do not implicitly disable hardware interrupts, meaning that acquiring dump_lock inside a hard IRQ context (e.g., during sched_tick → timer_interrupt) while the lock is also acquired in non-IRQ context creates a deadlock-prone inconsistency detected by the kernel's lockdep validator. The specific scenario involves raw_spin_rq_lock_nested being taken in a hard IRQ handler while dump_lock is held in a context where IRQs are enabled, violating locking ordering invariants (Feedly). Patches are referenced at kernel stable commits 5f02151c411d, 13d1c96d3a9f, and b6109750063d (kernel.org).

Exploitation of this vulnerability on CONFIG_PREEMPT_RT=y kernels can result in kernel deadlocks or system hangs, impacting availability. The unsafe locking scenario could cause the scheduler to enter an inconsistent state, potentially leading to denial of service on affected real-time Linux systems. Confidentiality and integrity impacts are considered low, as this is primarily a stability/availability issue rather than a privilege escalation or data exposure vulnerability (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-68202. The vulnerability is only triggerable on systems built with CONFIG_PREEMPT_RT=y (real-time preemption), which limits the affected population to specialized real-time Linux deployments. The EPSS score is 0.017%, indicating a very low probability of exploitation in the near term, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Apply the upstream Linux kernel patches that fix the unsafe locking in scx_dump_state() — stable commits 5f02151c411d, 13d1c96d3a9f, and b6109750063d address this issue (kernel.org). As a workaround, systems not requiring real-time preemption can avoid the issue by not enabling CONFIG_PREEMPT_RT=y in their kernel build configuration. Administrators should monitor vendor distributions (e.g., Red Hat, Ubuntu) for backported fixes and apply kernel updates as they become available.