CVE-2025-68357: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68357 is a Linux kernel vulnerability in the iomap subsystem where the s_dio_done_wq workqueue is not allocated for asynchronous direct I/O reads, potentially causing a NULL pointer dereference or system crash. The flaw was introduced by commit 222f2c7c6d14 ("iomap: always run error completions in user context"), which deferred read error completions to s_dio_done_wq without ensuring the workqueue was initialized for async read paths. It was disclosed on December 24, 2025, and affects Linux kernel versions from the initial commit through the fixes applied in 6.18.2 and 6.19-rc1. The CVSS v3.1 base score is 5.5 (Medium), requiring local access with low privileges (Red Hat CVE, Red Hat Bugzilla).

The root cause is a missing workqueue allocation in the iomap direct I/O async read code path (CWE-476: NULL Pointer Dereference). Since commit 222f2c7c6d14, read error completions are deferred to s_dio_done_wq; however, this workqueue was only allocated for async write operations, not async reads. When an async direct I/O read encounters an error, the kernel attempts to queue work to an uninitialized s_dio_done_wq, resulting in a NULL pointer dereference and kernel panic. Exploitation requires a local attacker with low privileges to trigger an async direct I/O read error on an affected filesystem (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes a kernel NULL pointer dereference, leading to a system crash (kernel panic) and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Affected systems running workloads that perform asynchronous direct I/O reads (e.g., database servers, high-performance storage applications) are at risk of unexpected downtime (Red Hat CVE).

Patches are available in Linux kernel versions 6.18.2 and 6.19-rc1, which ensure s_dio_done_wq is allocated for async read paths as well as write paths. Downstream distributions including Red Hat, Debian (linux-signed-amd64 6.12.69+1), and Oracle Linux have issued or are tracking patches. Administrators should update to the latest patched kernel version for their distribution. As a temporary workaround, limiting local user access and avoiding workloads that trigger async direct I/O read errors can reduce exposure (Red Hat CVE, Red Hat Bugzilla).