Deadlock Vulnerability in Linux Kernel NVMe Driver

CVE-2025-68756

What is CVE-2025-68756?

A deadlock vulnerability exists in the Linux kernel's NVMe driver due to improper handling of tagsets when managing shared and unshared queues. The functions blk_mq_add_queue_tag_set() and blk_mq_del_queue_tag_set() attempt to quiesce queues while holding a mutex lock, leading to a situation where threads may indefinitely block each other. Specifically, this occurs when one thread tries to disable a controller while another is waiting to freeze queues, causing a standstill. The resolution involves updating these functions to utilize RCU (Read-Copy Update) for safer list operations during tag manipulation, eliminating the risk of deadlock.

References