CVE-2025-68780: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68780 is a scheduling vulnerability in the Linux kernel's deadline scheduler that can cause denial of service by routing deadline tasks to powered-down CPUs. The flaw was published on January 13, 2026, and affects the Linux kernel, specifically confirmed in Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.119.3-3. It carries a CVSS v3.1 base score of 5.5 (Medium), with availability impact rated High (Feedly, Microsoft MSRC).

The root cause lies in incorrect state management within the cpudl_clear function of the Linux kernel's deadline scheduler (CWE-664: Improper Control of a Resource Through its Lifetime). Commit 16b269436b72 introduced cpudl_set/clear_freecpu functions to synchronize the cpu_dl::free_cpus mask with runqueue online state, and a subsequent commit (9659e1eeee28) removed the cpu_active_mask check from cpudl_find() on the assumption that free_cpus was always accurate. However, cpudl_clear can incorrectly set the free_cpus bit for a CPU whose deadline runqueue is offline — for example, when the last deadline task is migrated from a CPU with an offlined runqueue — leaving a stale bit that persists after CPU unplug. A different CPU transitioning through the default root domain may then attempt to push a deadline task to the powered-down CPU when cpudl_find sees its free_cpus bit set, preventing the task from running (Feedly).

Successful exploitation results in a denial-of-service condition where deadline-scheduled tasks fail to execute because they are incorrectly routed to offline CPUs. The impact is limited to availability (no confidentiality or integrity loss), but on systems relying on real-time or deadline scheduling — such as latency-sensitive workloads — this can cause critical tasks to hang indefinitely. The vulnerability requires local access with low privileges, limiting its scope to the affected host (Feedly).

Patches are available across multiple Linux distributions. Microsoft has released a fix for the affected Azure Linux 3 kernel package (azl3_kernel_6.6.119.3-3). The fix modifies cpudl_clear to check the deadline runqueue's online state before updating free_cpus, removes the cpudl_set/clear_freecpu functions, and replaces atomic cpumask operations with non-atomic ones protected under the cpudl lock. Upstream kernel patches are referenced at git.kernel.org (commits 3ed049fb, 91e448e6, 9019e399, 382748c0). Debian (DSA-6126-1, DLA-4476-1), Ubuntu (USN-8177-1/2, USN-8179-1/2/3/4, USN-8183-1/2, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2026-098), Oracle Linux 9, Red Hat, and SUSE have all issued updates. Administrators should apply available kernel security updates immediately and minimize CPU hotplug operations on deadline-scheduled workloads until patched (Feedly, Microsoft MSRC).