CVE-2025-68177: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68177 is a NULL pointer dereference vulnerability in the Linux kernel's cpufreq/longhaul driver, specifically in the longhaul_exit() function. The function called cpufreq_cpu_get(0) without validating the returned policy pointer, which could result in a NULL dereference leading to a kernel warning or panic on affected systems. The vulnerability was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. Patched versions include Linux 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18. The ENISA/EUVD base score is listed as 0.0, and no official CVSS score has been assigned at this time (Feedly).

The root cause is a missing NULL pointer check (CWE-476: NULL Pointer Dereference) in the longhaul_exit() cleanup function of the cpufreq/longhaul driver. When the driver is unloaded or the system shuts down, cpufreq_cpu_get(0) is called to retrieve the CPU frequency policy for CPU 0; however, on some systems this function may return NULL if no policy is registered, and the subsequent use of that pointer without validation causes a kernel panic or warning. The fix adds an unlikely() branch that returns early if the policy pointer is NULL, preventing the dereference. This is a local, kernel-level issue tied to specific hardware configurations using the VIA/Cyrix Longhaul CPU frequency scaling driver, referenced in Linux Bugzilla #219962 (Feedly).

Successful triggering of this vulnerability results in a kernel NULL pointer dereference, which can cause a kernel warning or system panic (crash), impacting availability. The primary impact is a denial of service — an affected system may become unresponsive or reboot unexpectedly during driver unload or system shutdown. There is no known confidentiality or integrity impact, and the vulnerability is limited to systems running the cpufreq/longhaul driver (typically older VIA/Cyrix processors) (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Users should update to the following fixed versions or later: Linux 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, or 6.18. Downstream distributions including Ubuntu (USN-8096-1, USN-8096-2, USN-8096-3, USN-8116-1), Debian (DLA-4436-1), and Amazon Linux 2 (ALAS2KERNEL-5.15-2025-096, ALAS2KERNEL-5.10-2026-112) have issued their own security advisories with updated kernel packages. As a workaround, systems not using VIA/Cyrix Longhaul hardware can safely blacklist or avoid loading the longhaul cpufreq module (Ubuntu Advisory, Amazon Linux Advisory, Debian LTS).