CVE-2025-68299: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68299 is a denial-of-service vulnerability in the Linux kernel's AFS (Andrew File System) subsystem caused by a race condition during delayed allocation of a cell's anonymous key. When afs_parse_source() parses a device name passed to mount() and calls afs_lookup_cell(), the subsequent key lookup may attempt to use the anonymous authentication key's description before it has been set by the background setup thread, resulting in a kernel oops (panic). The vulnerability was published on December 16, 2025, and affects the Linux kernel. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a time-of-check/time-of-use race condition (CWE-362) in the AFS kernel subsystem: the anonymous key for a cell is allocated in a background thread, but afs_request_key() and afs_request_key_rcu() may be called before that allocation completes, leading to a NULL dereference (kernel oops). The attack vector is local (AV:L), requiring low privileges (PR:L) and no user interaction. The fix involves three changes: allocating a reference name at cell record creation time, implementing on-demand allocation of the anonymous key with a mutex to prevent races, and making afs_request_key_rcu() return NULL when the key is not yet available so the caller can fall back to non-RCU mode (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a low-privileged local attacker to trigger a kernel panic (oops), causing a denial of service by crashing the affected system. There is no confidentiality or integrity impact; the vulnerability is limited to availability (high availability impact per CVSS). Systems using the AFS filesystem that are exposed to local, unprivileged users are at risk of unexpected reboots or system instability (Red Hat CVE, Red Hat Bugzilla).

Apply the upstream Linux kernel patch that resolves the race condition in the AFS anonymous key allocation (commits available in the stable kernel tree). Ubuntu has released fixes via security notices USN-8094-1 through USN-8094-5 and USN-8152-1 covering multiple kernel variants (Ubuntu USN-8094-1, Ubuntu USN-8094-2, Ubuntu USN-8094-3, Ubuntu USN-8094-4, Ubuntu USN-8094-5, Ubuntu USN-8152-1). As a workaround where patching is not immediately possible, restrict local system access to trusted users and avoid mounting AFS filesystems on multi-user systems until the patch is applied (Red Hat Bugzilla).