CVE-2025-68807: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68807 is a race condition vulnerability in the Linux kernel's block layer writeback throttling (WBT) subsystem. The flaw occurs between wbt_enable_default() and IO submission, causing the WBT inflight counter to become negative (-1), which leads to hung tasks in the writeback path. It was published on January 13, 2026, and affects the Linux kernel. Feedly estimates the severity as Medium, with an EPSS score of 0.000180 (Red Hat CVE, Feedly).

The root cause is a race condition (CWE-362) introduced when wbt_enable_default() was moved out of queue freezing in elevator_change(). This allows the WBT inflight counter to be decremented before proper initialization completes, because rwb_enabled() state can be updated between wbt_wait() (called via rq_qos_throttle()) and wbt_track() (called via rq_qos_track()). The result is an inflight counter value of -1 with has_waiters: True, causing tasks to block indefinitely in wbt_wait(). The fix splits wbt_enable_default() into __wbt_enable_default(), wbt_enable_default(), and a new wbt_init_enable_default() function used in blk_register_queue() to ensure atomic initialization (Red Hat CVE).

Successful exploitation of this race condition results in hung kernel tasks, specifically kworker threads blocking indefinitely in rq_qos_wait() → wbt_wait() → blk_mq_submit_bio(). This constitutes a denial-of-service condition affecting the availability of the writeback I/O path on the system. There is no evidence of confidentiality or integrity impact; the primary consequence is system instability or unresponsiveness on affected Linux kernel deployments (Red Hat CVE).

• Logs: Kernel hung task warnings in dmesg or /var/log/kern.log referencing kworker threads in state D (uninterruptible sleep) with call traces through rq_qos_wait, wbt_wait, __rq_qos_throttle, and blk_mq_submit_bio.
• Process: Kernel worker threads (kworker/u*) stuck in uninterruptible sleep (D state) visible via ps aux or top.
• System State: WBT inflight counter at -1 observable via kernel debug interfaces if WBT debug tracing is enabled.

The fix is included in upstream Linux kernel patches referenced by commits 9869d3a6fed3 and f55201fb3bec in the stable kernel tree. Ubuntu has issued security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 addressing this vulnerability. Red Hat has tracked the issue but has not yet assigned a severity rating. Users should update to a patched kernel version provided by their Linux distribution as soon as available (Ubuntu USN-8177-1, Ubuntu USN-8183-1, Red Hat CVE).