---
id: CVE-2025-68336
title: 'locking/spinlock/debug: Fix data-race in do_raw_write_lock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  locking/spinlock/debug: Fix data-race in do_raw_write_lock

  KCSAN reports:

  BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock

  write (marked) to 0xffff8000…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 <
    8e5b2cf10844402054b52b489b525dc30cc16908
  - >-
    Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 <
    c228cb699a07a5f2d596d186bc5c314c99bb8bbf
  - >-
    Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 <
    93bd23524d63deb80fb85beb2e43fafeb1043d0f
  - >-
    Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 <
    39d2ef113416f1a4205b03fb0aa2e428d1412c77
  - >-
    Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 <
    b163a5e8c703201c905d6ec7920ed79d167e8442
  - >-
    Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 <
    16b3590c0e1e615757dade098c8fbc0d4f040c76
  - >-
    Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 <
    396a9270a7b90886be501611b13aa636f2e8c703
  - >-
    Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 <
    c14ecb555c3ee80eeb030a4e46d00e679537f03a
  - Linux 3106fb78d3579c8e9c9b3040f7f7841981919624
  - Linux c0911024ff927ba5c4786b507004cb615be1d776
  - Linux 09226e5c38639437565af01e6009a9286a351d04
  - Linux c7673f01604fa722b9d7c1e29e17cec1b8ae09c5
  - Linux c120c3dbeb76305235c8e557f84d9e2d7d0f5933
  - Linux >= 4.4.209 < 4.5
  - Linux >= 4.9.209 < 4.10
  - Linux >= 4.14.164 < 4.15
  - Linux >= 4.19.95 < 4.20
  - Linux >= 5.4.11 < 5.5
  - Linux 5.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:04:42.942439Z'
published: '2025-12-22'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:43.012Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-68336'
references:
  - url: 'https://git.kernel.org/stable/c/8e5b2cf10844402054b52b489b525dc30cc16908'
  - url: 'https://git.kernel.org/stable/c/c228cb699a07a5f2d596d186bc5c314c99bb8bbf'
  - url: 'https://git.kernel.org/stable/c/93bd23524d63deb80fb85beb2e43fafeb1043d0f'
  - url: 'https://git.kernel.org/stable/c/39d2ef113416f1a4205b03fb0aa2e428d1412c77'
  - url: 'https://git.kernel.org/stable/c/b163a5e8c703201c905d6ec7920ed79d167e8442'
  - url: 'https://git.kernel.org/stable/c/16b3590c0e1e615757dade098c8fbc0d4f040c76'
  - url: 'https://git.kernel.org/stable/c/396a9270a7b90886be501611b13aa636f2e8c703'
  - url: 'https://git.kernel.org/stable/c/c14ecb555c3ee80eeb030a4e46d00e679537f03a'
tags:
  - cve.org
epss: 0.00466
epssPercentile: 0.38873
ingestedAt: '2026-10-16T17:24:46.631Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

locking/spinlock/debug: Fix data-race in do_raw_write_lock

KCSAN reports:

BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock

write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1:
 do_raw_write_lock+0x120/0x204
 _raw_write_lock_irq
 do_exit
 call_usermodehelper_exec_async
 ret_from_fork

read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0:
 do_raw_write_lock+0x88/0x204
 _raw_write_lock_irq
 do_exit
 call_usermodehelper_exec_async
 ret_from_fork

value changed: 0xffffffff -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111

Commit 1a365e822372 ("locking/spinlock/debug: Fix various data races") has
adressed most of these races, but seems to be not consistent/not complete.

>From do_raw_write_lock() only debug_write_lock_after() part has been
converted to WRITE_ONCE(), but not debug_write_lock_before() part.
Do it now.

## Affected

- `Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 < 8e5b2cf10844402054b52b489b525dc30cc16908`
- `Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 < c228cb699a07a5f2d596d186bc5c314c99bb8bbf`
- `Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 < 93bd23524d63deb80fb85beb2e43fafeb1043d0f`
- `Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 < 39d2ef113416f1a4205b03fb0aa2e428d1412c77`
- `Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 < b163a5e8c703201c905d6ec7920ed79d167e8442`
- `Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 < 16b3590c0e1e615757dade098c8fbc0d4f040c76`
- `Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 < 396a9270a7b90886be501611b13aa636f2e8c703`
- `Linux >= 1a365e822372ba24c9da0822bc583894f6f3d821 < c14ecb555c3ee80eeb030a4e46d00e679537f03a`
- `Linux 3106fb78d3579c8e9c9b3040f7f7841981919624`
- `Linux c0911024ff927ba5c4786b507004cb615be1d776`
- `Linux 09226e5c38639437565af01e6009a9286a351d04`
- `Linux c7673f01604fa722b9d7c1e29e17cec1b8ae09c5`
- `Linux c120c3dbeb76305235c8e557f84d9e2d7d0f5933`
- `Linux >= 4.4.209 < 4.5`
- `Linux >= 4.9.209 < 4.10`
- `Linux >= 4.14.164 < 4.15`
- `Linux >= 4.19.95 < 4.20`
- `Linux >= 5.4.11 < 5.5`
- `Linux 5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.