CVE-2025-68357 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
iomap: allocate s_dio_done_wq for async reads as well
Since commit 222f2c7c6d14 ("iomap: always run error completions in user context"), read error completions are deferred to s_dio_done_wq. This means the workqueue also needs to be allocated for async reads.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/12/2026
The vulnerability identified as CVE-2025-68357 resides within the Linux kernel's iomap subsystem, specifically addressing an issue related to asynchronous I/O operations and workqueue allocation. This flaw manifests in the kernel's handling of direct I/O operations where error completions are deferred to a dedicated workqueue. The vulnerability stems from an incomplete implementation of a previous commit that introduced error completion deferral to improve system stability and prevent potential deadlocks during I/O error processing.
The technical root cause of this vulnerability lies in the improper allocation of the s_dio_done_wq workqueue which is essential for handling asynchronous read operations. Prior to the problematic commit 222f2c7c6d14, the kernel's iomap subsystem managed error completions in a synchronous manner. However, this commit introduced a mechanism to defer error completions to user context to avoid potential kernel deadlocks and improve system responsiveness. The implementation failed to account for the fact that asynchronous reads also require this workqueue allocation, creating a scenario where the workqueue remains unallocated during async read operations, leading to potential system instability or crashes.
This vulnerability directly impacts the reliability and stability of Linux systems that rely heavily on direct I/O operations and asynchronous file system access. The operational consequences include potential system crashes, data corruption, or denial of service conditions when asynchronous read operations encounter errors that need to be deferred to the workqueue. The issue affects systems where applications frequently perform asynchronous I/O operations, particularly in high-performance computing environments, storage systems, or applications that utilize direct I/O for improved performance characteristics. The vulnerability creates a race condition scenario where error handling paths may fail due to missing workqueue resources, potentially leading to incomplete error recovery and system instability.
The mitigation strategy for CVE-2025-68357 involves ensuring that the s_dio_done_wq workqueue is properly allocated for both synchronous and asynchronous read operations. This requires applying the appropriate kernel patch that extends the workqueue allocation logic to include async reads, effectively resolving the inconsistency introduced by the previous commit. System administrators should prioritize updating their kernel versions to include the fix, particularly in production environments where direct I/O and asynchronous file operations are prevalent. The fix aligns with security best practices for kernel stability and follows the principle of least privilege by ensuring proper resource allocation for all I/O operation types. Organizations should also consider implementing monitoring solutions to detect potential system instability or performance degradation that might indicate the presence of this vulnerability in unpatched systems.
This vulnerability maps to CWE-691, which addresses insufficient control flow management, and relates to the ATT&CK technique T1499.004, which involves network disruption through resource exhaustion. The issue demonstrates how seemingly minor changes to kernel subsystems can have significant implications for system stability and security posture, highlighting the importance of thorough testing and validation of kernel modifications. The fix represents a standard defensive programming approach that ensures proper resource management and prevents potential denial of service conditions through inadequate workqueue handling.