CVE-2025-68253 mm: don't spin in add_stack_record when gfp flags don't allow
A local attacker can cause a denial of service by triggering a spin loop in the Linux kernel's page owner tracking when specific allocation contexts are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68253?
CVE-2025-68253 is a denial of service vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm: don't spin in add_stack_record when gfp flags don't allow
syzbot was able to find the following path: add_stack_record_to_list mm/page_owner.c:182 [inline] inc_stack_record_count mm/page_owner.c:214 [inline] __set_page_owner+0x2c3/0x4a0 mm/page_owner.c:333 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851 prep_new_page mm/page_alloc.c:1859 [inline] get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858 alloc_pages_nolock_noprof+0x94/0x120 mm/page_alloc.c:7554
Don't spin in add_stack_record_to_list() when it is called from *_nolock() context.
Which versions are affected by CVE-2025-68253?
How do I fix CVE-2025-68253?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-68253 being exploited?
There is no known exploitation of CVE-2025-68253 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68253, DEBIAN-CVE-2025-68253, GHSA-v2rp-vw7g-7xqw, UBUNTU-CVE-2025-68253.