CVE-2025-68253: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68253 is a Linux kernel vulnerability in the memory management subsystem, specifically in the add_stack_record_to_list() function within mm/page_owner.c. The flaw causes the kernel to spin (busy-wait) when called from a *_nolock() context with GFP flags that do not permit blocking, which can lead to a system hang or denial of service. It was discovered via syzbot (Google's kernel fuzzer) and published on December 16, 2025. Affected versions include Linux kernel commits from 97769a53f117 up to (but not including) the fix commits; patched versions include 6.17.6 and 6.18. No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium (Feedly, NVD).

The root cause is an improper spin-wait loop in add_stack_record_to_list() (mm/page_owner.c:182) that does not check whether the current GFP (Get Free Pages) allocation flags permit sleeping or blocking. When invoked from alloc_pages_nolock_noprof() — a non-locking memory allocation path — the function spins indefinitely because it cannot safely acquire the necessary lock under the *_nolock() context. The call chain identified by syzbot is: alloc_pages_nolock_noprof → get_page_from_freelist → prep_new_page → post_alloc_hook → set_page_owner → __set_page_owner → inc_stack_record_count → add_stack_record_to_list. The fix prevents spinning when GFP flags disallow it, instead gracefully skipping the stack record operation (NVD, kernel.org patch 1, kernel.org patch 2).

Successful triggering of this vulnerability causes the affected Linux kernel to enter an infinite spin loop within the memory management subsystem, resulting in a denial of service (system hang or CPU lockup). The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Because the vulnerable code path is in the page allocation subsystem, a triggered hang could affect the entire system, not just a single process or service (NVD, Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability. The fix is included in kernel version 6.17.6 and 6.18, corresponding to commits 504174133453e3af73e626e328603d7eb5986f34 and c83aab85e18103a6dc066b4939e2c92a02bb1b05. Administrators should update to a patched kernel version as soon as possible. As a temporary workaround, disabling the page_owner kernel feature (by not setting page_owner=on at boot) may prevent the vulnerable code path from being exercised, though this is a debug feature and typically not enabled in production kernels (kernel.org patch 1, kernel.org patch 2, NVD).