CVE-2025-68187: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68187 is a null/invalid pointer dereference vulnerability in the Linux kernel's MDIO subsystem, specifically in the airoha_mdio_probe() function of the net/mdio driver. The vulnerability arises because the return value of device_node_to_regmap() — which can be an ERR_PTR() on failure — is stored without validation, potentially leading to a kernel crash if the pointer is later dereferenced. It was published on December 16, 2025, and affects Linux kernel versions in the range introduced by commit 67e3ba978361 up to the fixes applied in kernel 6.17.8 and 6.18. The CVSS base score is listed as 0.0 (no severity rating assigned at time of publication), and the EPSS score is approximately 0.018% (Feedly, ENISA EUVD).

The root cause is a missing error check (CWE-252: Unchecked Return Value / CWE-476: NULL Pointer Dereference) in the airoha_mdio_probe() function within the Linux kernel's MDIO network driver. When device_node_to_regmap() fails during regmap initialization, it returns an ERR_PTR() value rather than a valid pointer; the driver previously stored this value directly without calling IS_ERR() to validate it. If the stored pointer is subsequently dereferenced during normal driver operation, the kernel would encounter an invalid memory access, resulting in a crash (kernel oops or panic). The fix adds an IS_ERR() check immediately after the device_node_to_regmap() call and returns the appropriate error code to abort the probe path safely (Feedly, Kernel Fix 1, Kernel Fix 2).

Exploitation of this vulnerability could cause a kernel crash (denial of service) on affected Linux systems running the Airoha MDIO driver, as an invalid pointer dereference in kernel space typically results in a kernel oops or panic. The impact is primarily an availability concern — a system crash or reboot — rather than a confidentiality or integrity breach, since the flaw is triggered during driver probe when regmap initialization fails. Systems using hardware that relies on the airoha_mdio driver (e.g., Airoha-based networking hardware) are within the affected asset scope (Feedly).

There is no known public exploit code, proof-of-concept, or evidence of in-the-wild exploitation for CVE-2025-68187. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require the ability to trigger a regmap initialization failure on a system running the affected Airoha MDIO driver, which is a narrow and hardware-specific attack surface (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in kernel versions 6.17.8 (commit b2b526c2cf57) and 6.18 (commit dc8ed3823473). Users running affected kernel versions with Airoha MDIO hardware should update to Linux kernel 6.17.8 or later, or apply the 6.18 stable release. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (Kernel Fix 1, Kernel Fix 2).