CVE-2025-68218nvme-multipath: fix lockdep WARN due to partition scan work
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix lockdep WARN due to partition scan work Blktests test cases nvme/014, 057 and 058 fail occasionally due to a lockdep WARN. As reported in the Closes tag URL, the WARN indicates that a deadlock can happen due to the dependency among disk->open_mutex, kblockd workqueue completion and partition_scan_work completion. To avoid the lockdep WARN and the potential deadlock, cut the dependency by running the partition_scan_work not by kblockd workqueue but by nvme_wq.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 60de2e03f984cfbcdc12fa552f95087c35a05a98 before 89456dab7ba5ab63d60945440926673a3205e829; from 4a57f42e5ed42cb8f1beb262c4f6d3e698939e4e before e2a897ad5f538d314955c747a0a2edb184fcdecd; from 1f021341eef41e77a633186e9be5223de2ce5d48 before ef4ab2a8abe554379e10303ae86f7c501336ba0d; from 1f021341eef41e77a633186e9be5223de2ce5d48 before b03eb63288a8ffe3adfb34e68309c8e2edb06d0b; from 1f021341eef41e77a633186e9be5223de2ce5d48 before 6d87cd5335784351280f82c47cc8a657271929c3; a91b7eddf45afeeb9c5ece11dddff5de0921b00f; from 6.1.118 before 6.1.159; from 6.6.62 before 6.6.118; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/89456dab7ba5ab63d60945440926673a3205e829
- https://git.kernel.org/stable/c/e2a897ad5f538d314955c747a0a2edb184fcdecd
- https://git.kernel.org/stable/c/ef4ab2a8abe554379e10303ae86f7c501336ba0d
- https://git.kernel.org/stable/c/b03eb63288a8ffe3adfb34e68309c8e2edb06d0b
- https://git.kernel.org/stable/c/6d87cd5335784351280f82c47cc8a657271929c3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.