CVE-2025-68244: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68244 is a lock inversion vulnerability in the Linux kernel's DRM/i915 graphics driver that can lead to a circular locking dependency and potential system instability. The flaw occurs when pinning a VMA to the GGTT address space on Cherry View (CHV) family processors or Broxton (BXT) generation SoCs with VT-d (Intel Virtualization Technology for Directed I/O) enabled, where stop_machine() is called from intel_ggtt_bind_vma() while holding the reservation_ww_class_mutex, potentially inverting the lock order with cpu_hotplug_lock. The vulnerability was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. It carries an EPSS score of approximately 0.024% (low probability of exploitation) (Feedly, CVE.org).

The root cause is a lock ordering violation (CWE-667: Improper Locking) in the drm/i915 subsystem. On completion of i915_vma_pin_ww(), a synchronous dma_fence_work_commit() is called; when the target hardware requires stop_machine() (invoked from intel_ggtt_bind_vma()), this creates a circular dependency between reservation_ww_class_mutex and cpu_hotplug_lock. The kernel's lockdep subsystem detects this as a potential deadlock: the task holds reservation_ww_class_mutex while attempting to acquire cpu_hotplug_lock, but an existing dependency chain requires the opposite order. This condition is specific to Cherry View family processors and Broxton SoCs with VT-d enabled, as those platforms use stop_machine() for GGTT binding operations (Feedly).

The primary impact is a potential kernel deadlock or system hang on affected hardware configurations (Cherry View and Broxton with VT-d), which would result in a denial of service. The vulnerability affects availability of systems running the Linux kernel with the i915 driver on the specified hardware. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly, CVE.org).

The fix has been applied to multiple Linux kernel stable branches via upstream commits (e.g., 3dec22bde207, 4e73066e3323, 20d94a6117b7, 84bbe327a5cb, 858a50127be7). Downstream distributions have released patched kernels: Ubuntu issued USN-8096-1, USN-8096-2, USN-8096-3, and USN-8116-1; Debian issued DLA-4436-1 for the 6.1 LTS branch; and Amazon Linux 2 released ALAS2KERNEL-5.15-2025-096. Users should update to the latest patched kernel version provided by their distribution. Systems not using Cherry View or Broxton hardware with VT-d enabled are not affected by this specific code path (Ubuntu Advisory, Debian LTS, Amazon Linux).