CVE-2025-68223: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68223 is a deadlock vulnerability in the Linux kernel's drm/radeon GPU driver. The flaw exists in the radeon_fence_is_signaled() function, which incorrectly calls radeon_fence_process() to advance the wait queue while the fence lock may already be held — causing a self-deadlock, since the fence lock and wait queue lock are the same object in radeon. It was published on December 16, 2025, and affects Linux kernel versions from 3.18 up to (but not including) 6.1.162, 6.2 through 6.6.122, 6.7 through 6.12.59, and 6.13 through 6.17.9, as well as release candidates 6.18-rc1 through rc6. The CVSS v3.1 base score is 5.5 (Medium) (Feedly).

The root cause is improper locking (CWE-667) in the drm/radeon subsystem. The dma_fence_ops::signaled callback can be invoked with the fence lock in an unknown state; for radeon, this lock is shared with the wait queue lock. When signaled() internally calls radeon_fence_process() to advance the queue, it attempts to re-acquire the already-held lock, resulting in a self-deadlock. The fix removes the radeon_fence_process() call from the is_signaled path entirely — returning false from signaled() when uncertain is acceptable behavior and avoids the deadlock. The upstream fix was cherry-picked from commit 527ba26e50ec2ca2be9c7c82f3ad42998a75d0db (Feedly, Kernel Patch).

Successful exploitation allows a local attacker with low privileges to trigger a kernel-level deadlock in the radeon GPU driver, resulting in a denial of service — specifically, freezing GPU processing and potentially halting system operations that depend on GPU resources. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS A:H). Systems running affected kernel versions with AMD/ATI Radeon GPUs are at risk of becoming unresponsive until rebooted (Feedly).

Update the Linux kernel to a patched stable version: 6.1.162 or later (for the 6.1 LTS branch), 6.6.123 or later, 6.12.60 or later, or 6.17.10 or later. Patches are available in the kernel stable repositories (Kernel Patch, Kernel Patch). Downstream distributions including Debian (DSA/DLA) and Ubuntu (USN-8094-x, USN-8152-1) have issued updated kernel packages. As a temporary workaround where patching is not immediately possible, restricting local user access on systems with radeon GPUs or disabling the radeon driver (if an alternative is available) can reduce exposure (Feedly).