CVE-2025-68224: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68224 is a rejected/withdrawn CVE that was originally associated with a Linux kernel regression in the SCSI subsystem's scsi_host_busy() function. The CVE was published on December 16, 2025, and has since been formally rejected by its CVE Numbering Authority (CNA) (CVE.org, Feedly). The underlying kernel issue involved a regression introduced by commit 995412e23bb2 ("blk-mq: Replace tags->lock with SRCU for tag iterators") affecting the Linux kernel across multiple stable branches. No CVSS score has been assigned given the rejected status; Feedly estimated a Medium severity category prior to rejection, and the EPSS score is 0.00024 (Feedly).

The original issue described in the EUVD entry (EUVD-2025-203672) was a kernel regression where scsi_host_busy() could be called before the SCSI host tag set was fully initialized, leading to an invalid SRCU read lock call trace during UFS driver initialization (EUVD). The root cause was that blk_mq_tagset_busy_iter() — invoked via scsi_host_busy() — was called in a context where tag_set->ops had not yet been set by scsi_mq_setup_tags(). The proposed fix added a check in scsi_host_busy() to verify whether the SCSI host tag set had been initialized before proceeding. Because this was a regression fix rather than a security vulnerability, the CVE was ultimately rejected by the Linux CNA.

As the CVE has been formally rejected, no security impact is officially attributed to CVE-2025-68224. The underlying kernel issue was a stability regression affecting UFS (Universal Flash Storage) driver initialization on platforms such as Rockchip, potentially causing a kernel call trace or system instability during boot — an availability concern rather than a confidentiality or integrity risk (EUVD).

CVE-2025-68224 has been rejected and carries no known exploit, PoC, or in-the-wild exploitation. The EPSS score is 0.00024 (very low probability of exploitation), and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly). No threat actor attribution exists for this identifier.

Because CVE-2025-68224 has been rejected, no security patching action is required specifically for this CVE identifier. The underlying kernel regression was addressed in multiple stable kernel releases: 5.10.247, 5.15.197, 6.1.159, 6.6.118, 6.12.60, 6.17.10, and 6.18 (EUVD). Administrators running affected kernel versions on UFS-equipped hardware (e.g., Rockchip platforms) should update to the patched stable releases to resolve the underlying stability regression.