CVE-2025-68320: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68320 is a Linux kernel vulnerability in the lan966x network driver where a mutex is incorrectly acquired within an atomic context, causing a kernel warning (BUG: sleeping function called from invalid context). The flaw was disclosed on December 16, 2025, and affects Linux kernel versions that include the lan966x driver (observed in kernel 6.18.0-rc2). It is classified as medium severity with an EPSS score of 0.000180 (Red Hat Bugzilla, Feedly).

The root cause is improper locking discipline (CWE-667: Improper Locking) in the lan966x_stats_get() function of the lan966x Ethernet network driver. This function acquires a mutex while executing in an atomic/preemptible context (preempt_count: 1), which is forbidden in the Linux kernel because mutexes may sleep. The bug is triggered when network device statistics are read — for example, via /proc/net/dev — during an SSH connection attempt, causing the kernel to emit a BUG: sleeping function called from invalid context warning. The fix replaces the mutex with a spinlock, which is safe to use in atomic contexts (Red Hat Bugzilla).

Exploitation of this vulnerability can lead to system instability or a kernel panic on devices using the lan966x network driver, particularly during network operations such as SSH connections or when reading network interface statistics. The availability impact is the primary concern, as the improper locking can cause unexpected kernel behavior. Confidentiality and integrity are not directly affected by this bug; the risk is limited to denial-of-service conditions on embedded or industrial systems using the affected Microchip lan966x Ethernet switch hardware (Red Hat Bugzilla, Feedly).

The recommended remediation is to update to a patched Linux kernel version that replaces the mutex with a spinlock in the lan966x_stats_get() function. Upstream kernel patches have been submitted and are tracked via the kernel stable tree (commits 3ac743c60ec5, 5a5d2f772775, 0216721ce712, c8ab03aa5bd9). SUSE has also issued a kernel security advisory (SUSE-2026-0447-1) incorporating this fix. Users should apply the latest kernel update for their distribution and monitor system logs for the BUG: sleeping function called from invalid context warning as an indicator of the unpatched condition (Red Hat Bugzilla, Feedly).