Linux Kernel up to 6.18.2/6.19-rc1 bdev_open file descriptor consumption

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.18.2/6.19-rc1. It has been rated as critical. The impacted element is the function bdev_open. The manipulation leads to file descriptor consumption. This vulnerability is referenced as CVE-2025-68823. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.2/6.19-rc1 and classified as critical. This issue affects the function bdev_open. The manipulation with an unknown input leads to a file descriptor consumption vulnerability. Using CWE to declare the problem leads to CWE-769. This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774. Impacted is availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: ublk: fix deadlock when reading partition table When one process(such as udev) opens ublk block device (e.g., to read the partition table via bdev_open()), a deadlock[1] can occur: 1. bdev_open() grabs disk->open_mutex 2. The process issues read I/O to ublk backend to read partition table 3. In __ublk_complete_rq(), blk_update_request() or blk_mq_end_request() runs bio->bi_end_io() callbacks 4. If this triggers fput() on file descriptor of ublk block device, the work may be deferred to current task's task work (see fput() implementation) 5. This eventually calls blkdev_release() from the same context 6. blkdev_release() tries to grab disk->open_mutex again 7. Deadlock: same task waiting for a mutex it already holds The fix is to run blk_update_request() and blk_mq_end_request() with bottom halves disabled. This forces blkdev_release() to run in kernel work-queue context instead of current task work context, and allows ublk server to make forward progress, and avoids the deadlock. [axboe: rewrite comment in ublk]

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2025-68823 since 12/24/2025. The exploitation is known to be difficult. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 283661 (Linux Distros Unpatched Vulnerability : CVE-2025-68823), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.3 or 6.19-rc2 eliminates this vulnerability. Applying the patch 0460e09a614291f06c008443f47393c37b7358e7/c258f5c4502c9667bccf5d76fa731ab9c96687c1 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (283661). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.19-rc1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion