CVE-2025-68180: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68180 is a NULL pointer dereference vulnerability in the Linux kernel's AMD GPU display driver (drm/amd/display) within the odm_combine_segments_show debugfs function. The flaw occurs when a connector is connected but inactive (e.g., disabled by a desktop environment), causing pipe_ctx->stream_res.tg to be destroyed; a subsequent read of the odm_combine_segments debugfs file then triggers a kernel NULL pointer dereference. It was published on December 16, 2025, and affects the Linux kernel (CVE Record, Feedly). A CVSS score has not been publicly assigned at this time.

The root cause is a NULL pointer dereference (CWE-476) in the odm_combine_segments_show function within the AMD display driver (drivers/gpu/drm/amd/display). When a display connector is connected but its pipeline is inactive — a common state when a desktop environment disables a monitor — the timing generator (pipe_ctx->stream_res.tg) is freed/destroyed. If a user or process reads the odm_combine_segments debugfs entry at this point, the kernel attempts to dereference the now-NULL tg pointer, resulting in a page fault at address 0x0000000000000000 in kernel mode. The crash was observed on kernel 6.17.0+ on a Lenovo system with an AMD GPU, with the faulting instruction at odm_combine_segments_show+0x93/0xf0 in the amdgpu module (Feedly). Fixes are available via stable kernel commits (Kernel Git).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic (Oops) and system crash, directly impacting availability. Because the trigger requires reading a debugfs file (typically accessible only to root or privileged users), the practical impact is a local denial of service on systems with AMD GPUs where the debugfs filesystem is mounted and accessible. There is no evidence of confidentiality or integrity impact beyond the system crash (Feedly).

1. Precondition: Obtain local access to a Linux system with an AMD GPU and the amdgpu kernel module loaded, where the debugfs filesystem is mounted (typically at /sys/kernel/debug).
2. Trigger inactive connector state: Ensure a display connector is physically connected but logically disabled (e.g., by a desktop environment disabling a secondary monitor, or by manually disabling the output via xrandr or drm utilities), causing pipe_ctx->stream_res.tg to be freed.
3. Read the vulnerable debugfs entry: As a privileged user (root), execute cat /sys/kernel/debug/dri/<card>/odm_combine_segments (or equivalent path for the AMD GPU device).
4. Kernel crash: The kernel attempts to dereference the NULL tg pointer in odm_combine_segments_show, triggering a NULL pointer dereference and kernel panic (system crash/denial of service) (Feedly).

• Logs: Kernel oops messages in dmesg or /var/log/kern.log referencing BUG: kernel NULL pointer dereference, address: 0000000000000000 and RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu].
• Logs: Stack traces showing odm_combine_segments_show in the call chain within kernel crash logs.
• Process: Processes (e.g., cat) accessing /sys/kernel/debug/dri/*/odm_combine_segments immediately before a system crash.
• System: Unexpected system reboots or kernel panics on hosts with AMD GPUs and connected-but-inactive display connectors (Feedly).

Apply the upstream Linux kernel patches that add a NULL check for pipe_ctx->stream_res.tg before dereferencing it in odm_combine_segments_show. The fixes are available in stable kernel commits: 6dd97ceb, c05fe5d4, and d990c7f1. As a workaround, restrict access to the debugfs filesystem (e.g., mount with debugfs access limited to root, or unmount /sys/kernel/debug on production systems) to reduce exposure. Users should update to a patched kernel version as soon as one is available from their distribution (Feedly, Kernel Git).