CVE-2025-68756

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock

blk_mq_{add,del}_queue_tag_set() functions add and remove queues from

tagset, the functions make sure that tagset and queues are marked as

shared when two or more queues are attached to the same tagset.

Initially a tagset starts as unshared and when the number of added

queues reaches two, blk_mq_add_queue_tag_set() marks it as shared along

with all the queues attached to it. When the number of attached queues

drops to 1 blk_mq_del_queue_tag_set() need to mark both the tagset and

the remaining queues as unshared.

Both functions need to freeze current queues in tagset before setting on

unsetting BLK_MQ_F_TAG_QUEUE_SHARED flag. While doing so, both functions

hold set->tag_list_lock mutex, which makes sense as we do not want

queues to be added or deleted in the process. This used to work fine

until commit 98d81f0df70c ("nvme: use blk_mq_[un]quie

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References