CVE-2025-68807

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

block: fix race between wbt_enable_default and IO submission

When wbt_enable_default() is moved out of queue freezing in elevator_change(),

it can cause the wbt inflight counter to become negative (-1), leading to hung

tasks in the writeback path. Tasks get stuck in wbt_wait() because the counter

is in an inconsistent state.

The issue occurs because wbt_enable_default() could race with IO submission,

allowing the counter to be decremented before proper initialization. This manifests

as:

rq_wait[0]:

inflight: -1

has_waiters: True

rwb_enabled() checks the state, which can be updated exactly between wbt_wait()

(rq_qos_throttle()) and wbt_track()(rq_qos_track()), then the inflight counter

will become negative.

And results in hung task warnings like:

task:kworker/u24:39 state:D stack:0 pid:14767

Call Trace:

rq_qos_wait+0xb4/0x150

wbt_wait+0xa9/0x100

__rq_qos_throttle+0x24/0

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References