CVE-2025-68310: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68310 is a deadlock vulnerability in the Linux kernel's s390 PCI error recovery subsystem that can cause a Denial of Service. The flaw arises from an interaction between the s390 PCI error recovery path and the mlx5 network adapter's crash dump (crdump) collection mechanism, causing kernel tasks to hang indefinitely. It was disclosed on December 16, 2025, and affects the Linux kernel on s390 architecture systems using mlx5 network adapters. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a deadlock (CWE-667: Improper Locking) in the s390 PCI error recovery code, which incorrectly uses pci_dev_lock() — which internally calls pci_cfg_access_lock() to block PCI config space accesses — rather than acquiring only device_lock() as powerpc's EEH and generic PCI AER processing do. This creates a circular lock dependency: the kmcheck task running mlx5_unload_one() attempts to acquire the devlink lock while the PCI error recovery code holds block_cfg_access, while simultaneously a kworker task running mlx5_crdump_collect() attempts to acquire block_cfg_access via pci_cfg_access_lock() while the devlink lock is already held. The deadlock can also be triggered manually by issuing devlink health dump show pci/ reporter fw_fatal while PCI error recovery is executing on the same physical function, or on s390 by injecting a firmware reset via zpcictl --reset-fw (Red Hat Bugzilla).

Successful triggering of this vulnerability causes kernel tasks to enter an uninterruptible sleep state (state:D), resulting in a system hang or severe degradation of availability. During testing, two tasks (kmcheck and kworker/u1664:6) were observed blocked for over 122 seconds, with the mlx5 health recovery flow aborting due to PCI reads not working. The impact is limited to availability (no confidentiality or integrity impact), and is scoped to s390 architecture systems running mlx5 network adapters where PCI error recovery and crdump collection can occur concurrently (Red Hat Bugzilla, Red Hat Advisory).

• Logs: Kernel messages indicating tasks blocked for more than 120 seconds, e.g., INFO: task kmcheck:<pid> blocked for more than 122 seconds or INFO: task kworker/u<N>:<pid> blocked for more than 122 seconds in /var/log/kern.log or dmesg output.
• Logs: mlx5 health recovery abort messages: mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid <N>): health recovery flow aborted, PCI reads still not working.
• Logs: Kernel call traces referencing pci_wait_cfg, pci_cfg_access_lock, mlx5_vsc_gw_lock, mlx5_crdump_collect, zpci_event_attempt_error_recovery, or mlx5_pci_err_detected in hung task dumps.
• Process: Processes in uninterruptible sleep (state D) visible via ps aux or top, particularly kmcheck or kworker threads associated with mlx5.

The fix modifies the s390 PCI error recovery path to acquire only device_lock() instead of pci_dev_lock(), eliminating the circular lock dependency. Patches have been committed to the stable Linux kernel trees (commits 0fd20f65df6a, 54f938d9f569, 3591d56ea9bf, b63c061be622). Downstream vendors including SUSE have released updated kernel packages (e.g., SUSE-SU-2026:21834-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1). Administrators should update to a patched kernel version as the primary remediation; as a temporary measure, avoiding simultaneous PCI error recovery and devlink health dump collection on affected s390 systems can reduce the risk of triggering the deadlock (Red Hat Bugzilla, SUSE Advisory).