CVE-2025-68357

What it actually does

Missing allocation of s_dio_done_wq for async reads causes null pointer dereference or invalid workqueue access when read error completions are deferred to user context.

Why it matters to the business

Kernel instability or crashes during async I/O error paths on Linux systems using iomap-based filesystems, with low observed exploitation risk despite broad kernel deployment.

How an attack unfolds

An attacker triggers async read operations on an iomap filesystem followed by deliberate I/O errors; the error handler attempts to queue work on an unallocated s_dio_done_wq, resulting in memory corruption or panic.

How to fix it

Update Linux kernel to commit 51297686e00f4d5d941b0f20f12b2f12879d753c or later; update sriov-network-device-plugin-fips to version 3.9.0-r5 or newer.

How to confirm the fix worked

Verify kernel source contains the allocation for async reads in iomap; confirm no null workqueue dereference under injected read errors; check running kernel git hash or package version against fixed revisions.

Typical attack path

1. Mount or access filesystem using iomap for async reads
2. Induce I/O error during async read (via storage fault, device manipulation, or error injection)
3. Error completion defers to s_dio_done_wq without prior allocation
4. Kernel dereferences invalid workqueue pointer leading to crash or corruption

How to detect it

Inspect dmesg and kernel logs for oops or panic traces referencing iomap error completions or s_dio_done_wq; correlate with async read workloads experiencing I/O faults.

What your security team should do

• Apply kernel updates containing commit 51297686e00f4d5d941b0f20f12b2f12879d753c immediately on all affected systems
• Prioritize patching in environments with heavy async I/O workloads
• Monitor kernel logs for iomap-related workqueue panics as interim detection