CVE-2025-68356: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68356 is a vulnerability in the Linux kernel's GFS2 (Global File System 2) subsystem that can cause recursive memory reclaim, leading to potential deadlocks and excessive stack memory consumption. The issue was published on December 24, 2025, and affects the Linux kernel across multiple stable branches. The root cause is that new_inode() returns inodes with i_mapping->gfp_mask set to GFP_HIGHUSER_MOVABLE, which includes the __GFP_FS flag, allowing memory allocations to recurse into filesystem memory reclaim. No CVSS score has been officially assigned at this time, and the CVE status is listed as Unknown (Feedly).

The vulnerability is classified under improper resource management in the GFS2 filesystem driver (CWE-667, improper locking/resource management). When new_inode() creates a new inode, the associated address space's gfp_mask defaults to GFP_HIGHUSER_MOVABLE, which includes __GFP_FS. This means that memory allocations within that address space can trigger filesystem-level memory reclaim. Critically, functions like gfs2_unstuff_dinode() are called inside filesystem transactions and invoke filemap_grab_folio(), which can allocate a new folio and trigger memory reclaim; if reclaim then re-enters the filesystem and starts another transaction, a deadlock results. The fix removes the __GFP_FS flag from inode address space gfp_mask values in GFS2, consistent with how the "meta" and resource group address spaces were already handled using GFP_NOFS. The patch is modeled after commit ad22c7a043c2 from XFS, which addressed the same class of problem (Feedly).

Successful triggering of this vulnerability can result in a kernel deadlock, causing a complete denial of service on affected systems running GFS2 filesystems. The deadlock scenario arises when recursive filesystem transactions are initiated during memory reclaim, effectively hanging the kernel. Additionally, the recursive memory reclaim path can consume significant kernel stack memory, potentially leading to stack overflow conditions. Systems using GFS2 in clustered environments (e.g., Red Hat Cluster Suite) are particularly at risk, as GFS2 is commonly deployed in high-availability configurations where a kernel hang would impact service availability (Feedly).

The fix has been applied to multiple Linux kernel stable branches via patches committed to the kernel stable tree (commits 2c5f4a53476e, 9c0960ed1123, 49e7347f4644, and edb2b2556186). Users should update to a patched kernel version that includes these commits. Red Hat has acknowledged the vulnerability (tracked as RH:CVE-2025-68356), and Oracle Linux has issued an advisory (oracle9-el1986-50112). Organizations running GFS2 filesystems should prioritize applying the relevant kernel updates from their Linux distribution vendor. As a temporary workaround, avoiding the use of GFS2 filesystems or limiting workloads that heavily stress memory reclaim paths may reduce risk, though upgrading the kernel is the definitive remediation (Feedly, Tenable Nessus).

Coverage of CVE-2025-68356 has been limited to technical security scanning vendors and Linux security advisory aggregators. Tenable published Nessus detection plugins (299777 and 300556), and Qualys added detection support. The German Linux security news site pro-linux.de covered the vulnerability as part of broader Linux kernel security advisories. No notable researcher commentary or social media discussion has been identified beyond routine vulnerability tracking (Feedly).