CVE-2025-68218

What it actually does

Race condition creates lock dependency between disk->open_mutex, kblockd workqueue completion, and partition_scan_work that can trigger a deadlock or lockdep warning during NVMe multipath partition scanning.

Why it matters to the business

Systems using NVMe multipath storage may experience occasional kernel warnings, deadlocks, or test failures that reduce storage reliability and availability in Linux environments.

How an attack unfolds

An attacker triggers NVMe multipath operations that schedule partition scan work on the kblockd queue while holding open_mutex, exploiting the circular dependency to induce a deadlock or system hang.

How to fix it

Update the Linux kernel to version 6.1.159 or later containing commit 89456dab7ba5ab63d60945440926673a3205e829; Chainguard images should be updated to the 17.6.5-r0 releases that incorporate the fix.

How to confirm the fix worked

Verify the running kernel version is at or above the fixed release and confirm absence of the lockdep warning when running affected blktests nvme/014, 057, and 058 workloads.

Typical attack path

1. Initiate NVMe multipath device attachment or I/O workload
2. Trigger partition scanning via blktests or equivalent disk open operations
3. Force concurrent scheduling of partition_scan_work on kblockd while open_mutex is held
4. Reach the circular wait condition causing deadlock or lockdep warning

How to detect it

Search kernel logs and dmesg output for lockdep warnings referencing open_mutex, kblockd, partition_scan_work, or nvme-multipath deadlock messages; review system boot and storage attachment logs for related stalls.

• lockdep warning.*nvme-multipath
• deadlock.*partition_scan_work
• kblockd.*open_mutex

What your security team should do

• Apply the kernel update to 6.1.159 or equivalent fixed version immediately on all affected systems
• Prioritize patching NVMe multipath hosts given the potential for storage deadlocks
• Monitor kernel logs for lockdep warnings during storage initialization until patches are deployed