CVE-2025-68823: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68823 is a deadlock vulnerability in the Linux kernel's ublk (user block device) driver that allows a local low-privileged attacker to cause a denial of service (system hang). The flaw was published on January 13, 2026, and affects Linux kernel versions 6.0 through 6.6.123, 6.7 through 6.12.69, 6.13 through 6.18.2, and 6.19-rc1. It carries a CVSS v3.1 base score of 5.5 (Medium), classified as a local availability impact with no confidentiality or integrity consequences (Feedly, CVE Record).

The vulnerability is classified as CWE-667 (Improper Locking) and arises in the ublk driver's request completion path (__ublk_complete_rq()). When a process such as udev opens a ublk block device via bdev_open(), it acquires disk->open_mutex; subsequent I/O completion callbacks can trigger fput() on the ublk block device file descriptor, deferring work to the current task's task work queue, which eventually calls blkdev_release() — which attempts to re-acquire the already-held disk->open_mutex, causing a self-deadlock. The fix disables bottom halves during blk_update_request() and blk_mq_end_request() execution, forcing blkdev_release() into kernel work-queue context rather than the current task context, thereby breaking the deadlock cycle (Feedly, CVE Record).

Successful exploitation causes a permanent task hang, rendering the affected system or process completely unresponsive — a full denial of service. Because standard system utilities like udev routinely read partition tables on block device attachment, this deadlock can be triggered inadvertently in normal system operation, not just by a deliberate attacker. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing hung task warnings or lockdep splats referencing disk->open_mutex, blkdev_release, or __ublk_complete_rq.
• Process Behavior: Processes (e.g., udev, udevd, or block device utilities) entering an uninterruptible sleep state (D state in ps output) when accessing ublk block devices.
• System: System becoming unresponsive or requiring a hard reboot after attaching or scanning ublk block devices with partition tables.

Update to a patched Linux kernel version: 6.6.124 or later (for the 6.0–6.6.x branch), 6.12.70 or later (for the 6.7–6.12.x branch), 6.18.3 or later (for the 6.13–6.18.x branch), or 6.19-rc2 or later. Patches are available via the upstream kernel stable tree. As a temporary workaround until patching is complete, minimize use of ublk devices in production environments and restrict local user access to ublk block devices where possible. Debian (DSA-6141-1, linux 6.12.73) and Ubuntu (USN-8177-1, USN-8183-1, USN-8245-1, USN-8257-1, USN-8278-1, USN-8289-1, USN-8296-1) have released updated kernel packages addressing this issue (Feedly, Ubuntu USN-8177-1, Debian Advisory).

The vulnerability has been addressed in downstream distributions including Debian and Ubuntu, which have issued multiple security advisories covering this CVE as part of broader kernel update batches. No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified, consistent with its medium severity and lack of active exploitation (Debian Advisory, Ubuntu USN-8177-1).