CVE-2025-68182: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68182 is a use-after-free vulnerability in the Linux kernel's iwlwifi Wi-Fi driver, specifically within the iwl_mld_remove_link() function. The flaw arises because the code frees the link structure via kfree_rcu(link, rcu_head) and subsequently dereferences link->fw_id, creating a potential use-after-free condition. It was published on December 16, 2025, and affects Linux kernel versions in the range introduced by commit d1e879ec600f9b3bdd253167533959facfefb17b up to the patched commits. The CVSS base score is not yet assigned (listed as 0.0), and the EPSS score is approximately 0.018% (Feedly, EUVD).

The root cause is a classic use-after-free (CWE-416) in the Linux kernel's iwlwifi MLD (Multi-Link Device) driver. In iwl_mld_remove_link(), the link pointer is passed to kfree_rcu(), which schedules the memory for deallocation after the current RCU grace period; however, the code then reads link->fw_id after this call, meaning the memory could be freed before the dereference occurs under certain timing conditions. The fix saves the value of link->fw_id into a local variable before calling kfree_rcu(), eliminating the race. Patches are referenced in kernel stable commits 5b4a239c9f94 and 77e67d5daaf1 (Feedly, EUVD).

Exploitation of this use-after-free could lead to kernel memory corruption, potentially resulting in a system crash (denial of service) or, in more sophisticated scenarios, privilege escalation or arbitrary code execution in kernel context. The vulnerability is confined to systems using Intel Wi-Fi hardware managed by the iwlwifi driver with MLD link management active (e.g., Wi-Fi 7 / IEEE 802.11be multi-link operation). The practical exploitability for privilege escalation is constrained by the RCU timing window and the need for local access or specific triggering conditions (Feedly).

Apply the upstream Linux kernel patches that introduce the fix: stable commit 5b4a239c9f94e1606435f1842fc6fd426d607dbb (targeting the 6.17.x stable branch) and 77e67d5daaf155f7d0f99f4e797c4842169ec19e (targeting 6.18). Users should update to Linux kernel 6.17.8 or 6.18 (or later) once available from their distribution. As a temporary workaround, systems that do not use Intel Wi-Fi hardware or do not require the iwlwifi MLD feature can unload or blacklist the iwlwifi kernel module to eliminate exposure (Feedly, EUVD).