CVE-2025-68173

What it actually does

Excessive time spent calling kallsyms_lookup inside an RCU critical section with preemption disabled in ftrace_module_enable when a module exports many traceable functions, causing softlockup and kernel panic.

Why it matters to the business

Systems running affected Ubuntu 20.04 LTS kernels can panic or become unresponsive during boot or module load (e.g., amdgpu), producing unplanned downtime and requiring manual intervention or reboot.

How an attack unfolds

A local process or boot sequence loads a kernel module that registers a large number of functions; ftrace_module_enable iterates them under RCU with preemption off, exhausting the watchdog timer and triggering a softlockup identical to previously observed RCU stalls.

How to fix it

Upgrade the affected packages to the listed fixed versions: linux 5.4.0-9.12, linux-aws 5.4.0-1005.5, linux-aws-5.15 5.15.0-1014.18~20.04.1, linux-azure 5.4.0-1006.6, linux-azure-5.15 5.15.0-1007.8~20.04.1, linux-azure-fde-5.15 5.15.0-1019.24~20.04.1.1, linux-bluefield 5.4.0-1007.10, linux-gcp 5.4.0-1005.5, linux-gcp-5.15 5.15.0-1006.9~20.04.1, linux-gkeop 5.4.0-1008.9, linux-gkeop-5.15 5.15.0-1003.5~20.04.2, linux-hwe-5.15 5.15.0-33.34~20.04.1, linux-ibm 5.4.0-1003.4.

How to confirm the fix worked

After patching, confirm the running kernel version matches a fixed package release and verify that loading the previously problematic module no longer produces RCU or softlockup warnings in dmesg.

Typical attack path

1. Identify or cause loading of a kernel module containing thousands of traceable functions
2. Invoke insmod or allow the module to load during boot
3. Enter ftrace_module_enable under RCU read lock with preemption disabled
4. Perform repeated kallsyms_lookup calls without cond_resched
5. Trigger softlockup watchdog and kernel panic

How to detect it

Search kernel logs and dmesg for softlockup or RCU stall messages that reference ftrace_module_enable or repeated kallsyms_lookup calls during module load events.

• soft lockup.*ftrace_module_enable
• RCU stall.*kallsyms_lookup
• ftrace:.*cond_resched
• BUG: soft lockup.*CPU.*ftrace

What your security team should do

• Apply the exact fixed kernel package versions for each affected Ubuntu 20.04 flavor immediately
• Reboot systems into the updated kernel and test loading of high-function-count modules such as amdgpu
• Add kernel version checks to configuration management and vulnerability scanning pipelines
• Monitor dmesg and kernel logs for residual softlockup reports during the rollout window