CVE-2025-68250: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68250 is a Linux kernel vulnerability in the hung_task blocker tracking mechanism caused by unaligned lock pointers on certain architectures. The blocker tracking code assumes lock pointers are at least 4-byte aligned (to use lower bits for type encoding), but architectures such as m68k only guarantee 2-byte alignment of 32-bit values, causing two WARN_ON_ONCE checks to trigger. This was reported by Eero Tamminen and bisected by Geert Uytterhoeven. The vulnerability was published on December 16, 2025, and affects the Linux kernel; patches are available in stable commits targeting kernel versions up to 6.17.6 and 6.18. No CVSS score has been assigned by NVD; Feedly estimates the severity as Medium, and ENISA records a base score of 0.0 (Feedly, ENISA EUVD).

The root cause is an incorrect alignment assumption (CWE not formally assigned by NVD) in the Linux kernel's hung_task blocker tracking mechanism, which encodes type information in the lower bits of lock pointers. On architectures like m68k that only guarantee 2-byte alignment for 32-bit values, the lower bits used for encoding may already be set, violating the 4-byte alignment precondition and triggering WARN_ON_ONCE assertions. The fix adjusts runtime checks to silently skip any lock pointer that is not 4-byte aligned, effectively disabling the blocker tracking feature on affected architectures rather than triggering kernel warnings. The patches are referenced in stable kernel commits c0e2dcbe54cb and c97513cddcfc (kernel.org patch 1, kernel.org patch 2).

The primary impact of this vulnerability is the triggering of kernel warning messages (WARN_ON_ONCE) on architectures with 2-byte-aligned 32-bit values, such as m68k, which can degrade system stability and generate noise in kernel logs. The hung task blocker tracking feature is silently disabled on affected architectures as a result, reducing the kernel's ability to detect and report hung tasks. There is no evidence of confidentiality, integrity, or remote code execution impact; the issue is primarily an availability and diagnostic concern on niche architectures (Feedly, ENISA EUVD).

Apply the upstream Linux kernel patches referenced in stable commits c0e2dcbe54cb15ecdf9d8f4501c6720423243888 (for the 6.17.x branch) and c97513cddcfc235f2522617980838e500af21d01 (for the 6.16.x branch), which are included in kernel versions 6.17.6 and 6.18 respectively. Users running affected architectures (primarily m68k) should update to a patched kernel version. No configuration-based workaround is documented; the fix is purely a code-level adjustment in the kernel's hung task detection logic (kernel.org patch 1, kernel.org patch 2).