CVE-2025-68214

In the Linux kernel, the following vulnerability has been resolved: timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers(). The issue occurs when timer_shutdown_sync() clears the timer function to NULL while the timer is still running on another CPU. The race scenario looks like this: CPU0 CPU1 <SOFTIRQ> lock_timer_base() expire_timers() base->running_timer = timer; unlock_timer_base() [call_timer_fn enter] mod_timer() ... timer_shutdown_sync() lock_timer_base() // For now, will not detach the timer but only clear its function to NULL if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() [call_timer_fn exit] lock_timer_base() base->running_timer = NULL; unlock_timer_base() ... // Now timer is pending while its function set to NULL. // next timer trigger <SOFTIRQ> expire_timers() WARN_ON_ONCE(!fn) // hit ... lock_timer_base() // Now timer will detach if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() The problem is that timer_shutdown_sync() clears the timer function regardless of whether the timer is currently running. This can leave a pending timer with a NULL function pointer, which triggers the WARN_ON_ONCE(!fn) check in expire_timers(). Fix this by only clearing the timer function when actually detaching the timer. If the timer is running, leave the function pointer intact, which is safe because the timer will be properly detached when it finishes running.

• CWE-362

• https://git.kernel.org/stable/c/176725f4848376530a0f0da9023f956afcc33585Patch
• https://git.kernel.org/stable/c/1a975716cc8977f461e45e28e3e5977d46ad7a6aPatch
• https://git.kernel.org/stable/c/20739af07383e6eb1ec59dcd70b72ebfa9ac362cPatch
• https://git.kernel.org/stable/c/6665fbd7730b26d770c232b20d1b907e6a67a914Patch
• https://git.kernel.org/stable/c/a01efa7a780c42ac5170a949bd95c9786ffcc60aPatch
• https://git.kernel.org/stable/c/ba43ac025c4318241f8edf94f31d2eebab86991bPatch

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68209In the Linux kernel, the following vulnerability has been re…
• CVE-2025-6821A vulnerability was found in code-projects Inventory Managem…9.8
• CVE-2025-68210In the Linux kernel, the following vulnerability has been re…
• CVE-2025-68211In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-68212In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-68213In the Linux kernel, the following vulnerability has been re…
• CVE-2025-68215In the Linux kernel, the following vulnerability has been re…7
• CVE-2025-68216In the Linux kernel, the following vulnerability has been re…
• CVE-2025-68217In the Linux kernel, the following vulnerability has been re…
• CVE-2025-68218In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2025-68219In the Linux kernel, the following vulnerability has been re…
• CVE-2025-6822A vulnerability was found in code-projects Inventory Managem…9.8