CVE-2025-68333: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68333 is a deadlock vulnerability in the Linux kernel's sched_ext scheduler component, specifically in the deferred_irq_workfn() function. On kernels compiled with PREEMPT_RT=y, the function executes in a per-CPU irq_work/* task context without disabling IRQs; if the run queue (rq) returned by container_of() is the current CPU's rq, a recursive lock acquisition on rq->__lock can occur during interrupt handling, causing a deadlock. The vulnerability was disclosed on December 22, 2025, and affects Linux kernel versions 6.12 through 6.12.67, 6.13 through 6.17.11, and 6.18-rc1 through 6.18-rc6. It carries a CVSS v3.1 base score of 5.5 (Medium) (NVD, Red Hat Advisory).

The root cause is classified as CWE-667 (Improper Locking). In PREEMPT_RT kernels, irq_work callbacks are executed in a dedicated per-CPU kernel thread rather than in hard-IRQ context, meaning IRQs are not disabled during execution. When deferred_irq_workfn() acquires rq->__lock and an interrupt fires on the same CPU targeting the same rq, the interrupt handler attempts to re-acquire the same non-reentrant spinlock, resulting in a deadlock. The fix replaces init_irq_work() with IRQ_WORK_INIT_HARD() to initialize rq->scx.deferred_irq_work, ensuring the callback is always invoked in hard-IRQ context where IRQs are disabled, preventing the recursive lock scenario (NVD, kernel.org patch).

Successful triggering of this deadlock causes the affected CPU to become unresponsive due to the recursive lock attempt, leading to kernel hangs, interrupt handling failures, and overall system instability or unavailability. The impact is limited to availability (no confidentiality or integrity loss), and only systems with PREEMPT_RT enabled are affected — primarily real-time Linux deployments used in industrial, embedded, or latency-sensitive environments. There is no known path to privilege escalation or data exfiltration via this vulnerability (NVD, Feedly).

Update the Linux kernel to a patched version: 6.12.68 or later (for the 6.12.x series), 6.17.12 or later (for the 6.13–6.17 series), or 6.18 final release or later. Patch commits are available at the upstream stable kernel repository. Systems with PREEMPT_RT enabled should prioritize this update, as the deadlock condition is exclusive to that configuration. As a temporary workaround where patching is not immediately feasible, disabling PREEMPT_RT (if operationally acceptable) would eliminate the vulnerable code path (kernel.org patch, Ubuntu USN-8094).

Ubuntu issued multiple security notices (USN-8094-1 through USN-8094-5) addressing this and related kernel vulnerabilities, indicating broad downstream distribution patching activity (Ubuntu USN-8094-1). Red Hat tracked the issue via Bugzilla and published a CVE advisory page. The Yocto Project security mailing list also discussed the issue across several messages, reflecting awareness in embedded Linux communities (Yocto Security List). No significant social media controversy or high-profile researcher commentary has been observed.