CVE-2025-68333: sched_ext: Fix possible deadlock in the deferred_irq_workfn()
In the Linux kernel, the following vulnerability has been resolved:
schedext: Fix possible deadlock in the deferredirqworkfn()
For PREEMPTRT=y kernels, the deferredirqworkfn() is executed in the per-cpu irqwork/ task context and not disable-irq, if the rq returned by containerof() is current CPU's rq, the following scenarios may occur:
lock(&rq->lock); <Interrupt> lock(&rq->lock);
This commit use IRQWORKINITHARD() to replace initirqwork() to initialize rq->scx.deferredirqwork, make the deferredirqworkfn() is always invoked in hard-irq context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1009.9~24.04.2 - Upgrade
Upgrade
ubuntu/linux-azure-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1010.10~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1009.9~24.04.3 - Upgrade
Upgrade
ubuntu/linux-hwe-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-19.19~24.04.2 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracle-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1009.9~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-19.19.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.9~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.17.0-19.19 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.17.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.17.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.17.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.17.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.17.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.17.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.17.0-19.19.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Configuration
Replace init_irq_work() with IRQ_WORK_INIT_HARD() when initializing rq->scx.deferred_irq_work so deferred_irq_workfn() always runs in hard-IRQ context.
Linux kernel sched_ext rq->scx.deferred_irq_work initialization = IRQ_WORK_INIT_HARD()
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68333?
CVE-2025-68333 has a severity rating that indicates a significant impact on system reliability due to possible deadlock scenarios.
How do I fix CVE-2025-68333?
To fix CVE-2025-68333, update your Linux kernel to the latest stable version where this vulnerability has been resolved.
Which versions of the Linux Kernel are affected by CVE-2025-68333?
CVE-2025-68333 affects versions of the Linux kernel that utilize PREEMPT_RT=y configurations.
What is the nature of the issue in CVE-2025-68333?
The issue in CVE-2025-68333 involves a possible deadlock condition in the deferred_irq_workfn() execution.
Are there any workarounds for CVE-2025-68333?
Currently, the recommended approach for CVE-2025-68333 is to apply the official kernel patch rather than use workarounds.