CVE-2025-68322: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68322 is a Linux kernel vulnerability affecting the PA-RISC (parisc) architecture's stack unwinder, where an unaligned memory access can trigger a kernel crash and deadlock. The issue was reported by Guenter Roeck on an emulated B160L machine and disclosed on December 16, 2025. It affects all Linux kernel versions from the initial commit up to the fixes introduced in kernel 6.12.58, 6.17.8, and 6.18. The CVSS score has not been formally assigned, but Feedly estimates the severity as Medium with an EPSS score of 0.00017 (Feedly, ENISA EUVD).

The root cause is an improper alignment check (related to CWE-704/CWE-119 class issues) in the parisc architecture's stack unwinder (unwind_once). When generating a stack trace, the unwinder uses the current stack pointer to guess the previous frame and reads the previous stack pointer from memory without first verifying that the address is properly aligned. On parisc, unaligned memory accesses trigger the unalignment trap handler; if this occurs while a spinlock is already held (e.g., during slab allocation tracing), it causes spinlock recursion and ultimately a deadlock. The fix adds an alignment check before the memory access in the unwinder (Feedly, ENISA EUVD).

Successful triggering of this vulnerability results in a kernel deadlock (denial of service) on parisc-architecture systems. The crash manifests as a spinlock recursion bug (BUG: spinlock recursion) that halts the affected CPU, requiring a system reboot. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability on parisc hardware or emulated environments (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-68322. The vulnerability is architecture-specific (parisc only) and requires local conditions — such as triggering a stack trace during slab allocation — to reproduce the crash. The EPSS score is 0.00017, indicating very low probability of exploitation, and it is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, ENISA EUVD).

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable versions: 6.12.58, 6.17.8, and 6.18. The fix adds an alignment check in the parisc unwinder before accessing memory via the stack pointer. Administrators running parisc-based systems or emulators should update to one of the patched kernel versions. No configuration-based workaround is available (ENISA EUVD, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).

The vulnerability was noted in automated CVE tracking feeds and security aggregators shortly after disclosure. There is no significant vendor statement, notable researcher commentary, or broad media coverage beyond standard vulnerability database entries and automated alerts (Feedly).