CVE-2025-68336

In the Linux kernel, the following vulnerability has been resolved:

locking/spinlock/debug: Fix data-race in do_raw_write_lock

KCSAN reports:

BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock

write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1: do_raw_write_lock+0x120/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork

read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0: do_raw_write_lock+0x88/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork

value changed: 0xffffffff -> 0x00000001

Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111

Commit 1a365e822372 ("locking/spinlock/debug: Fix various data races") has adressed most of these races, but seems to be not consistent/not complete.

From do_raw_write_lock() only debug_write_lock_after() part has been converted to WRITE_ONCE(), but not debug_write_lock_before() part. Do it now.

A data race was found in the Linux kernel's spinlock debugging code. A previous fix for data races in do_raw_write_lock() was incomplete: only the debug_write_lock_after() portion was converted to WRITE_ONCE(), leaving a racy access in the debug_write_lock_before() portion that the Kernel Concurrency Sanitizer (KCSAN) reports when concurrent tasks acquire a write lock. The race is confined to lock-debugging instrumentation and has no network attack vector; it requires local access to the running kernel, so Red Hat rates this flaw LOW impact (availability only; Red Hat CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This is lower than the upstream CVE record's score of 7.5, whose network attack vector does not reflect the local, debug-only nature of the defect. The kernel and kernel-rt packages in Red Hat Enterprise Linux 8 (8.4 and later minor streams), Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 1 are affected; Red Hat Enterprise Linux 6, 7, and 8.2 are not affected because the vulnerable code is not present in those streams. For the affected streams the fix is deferred because the race affects debug bookkeeping rather than the correctness of the lock itself; the residual risk of running without the fix is limited to potentially incorrect spinlock debug diagnostics on systems using kernels built with these debugging options.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.