CVE-2025-68218 nvme-multipath: fix lockdep WARN due to partition scan work
A race condition in the Linux kernel NVMe multipath driver can cause a deadlock, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68218?
CVE-2025-68218 is a high-severity vulnerability in Linux, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvme-multipath: fix lockdep WARN due to partition scan work
Blktests test cases nvme/014, 057 and 058 fail occasionally due to a lockdep WARN. As reported in the Closes tag URL, the WARN indicates that a deadlock can happen due to the dependency among disk->open_mutex, kblockd workqueue completion and partition_scan_work completion.
To avoid the lockdep WARN and the potential deadlock, cut the dependency by running the partition_scan_work not by kblockd workqueue but by nvme_wq.
Which versions are affected by CVE-2025-68218?
How do I fix CVE-2025-68218?
Apply the vendor's patch.
Is CVE-2025-68218 being exploited?
There is no known exploitation of CVE-2025-68218 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68218, DEBIAN-CVE-2025-68218, GHSA-7fq2-6xq4-hq67, ROOT-OS-UBUNTU-2404-CVE-2025-68218, UBUNTU-CVE-2025-68218.