CVE-2025-68189: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68189 is a vulnerability in the Linux kernel's DRM/MSM (Direct Rendering Manager for Qualcomm Adreno GPUs) subsystem, specifically in the GEM (Graphics Execution Manager) object free path for imported dma-bufs. The flaw causes a kernel WARNING splat during object deallocation when imported dma-buf objects are freed, triggered during IRIS video playback scenarios. It was published on December 16, 2025, and affects the Linux kernel (vendor: linux, product: kernel) (Feedly). The CVSS score is not yet assigned as of the time of this report, and the CVE status is listed as Unknown (Feedly).

The root cause is an incorrect condition check in msm_gem_free_object() within drivers/gpu/drm/msm/msm_gem.c. Imported dma-buf objects have obj->resv != &obj->_resv (they use an external reservation object), but the code only checked the _NO_SHARE flag when deciding how to handle the reservation object during GEM object teardown — failing to account for the imported dma-buf case. This leads to a kernel WARN_ON at line 1127 of msm_gem.c when the wrong code path is taken during msm_gem_free_object. The fix adds a check for obj->resv != &obj->_resv in addition to the existing flags check, ensuring imported dma-bufs are handled correctly (Feedly). This is classified under improper resource management (CWE-related) in the kernel's DRM subsystem.

Exploitation of this vulnerability results in a kernel WARNING (WARN_ON) during GEM object deallocation for imported dma-bufs, which can cause instability or unexpected behavior in the DRM/MSM graphics subsystem on affected Qualcomm Adreno GPU systems. The issue was observed during IRIS (Intel's open-source video decoder, used here in a Qualcomm context) video playback on Linux 6.17.0-rc7, indicating it affects availability of the graphics stack rather than confidentiality or integrity (Feedly). There is no evidence of privilege escalation or data exfiltration risk; the primary impact is system stability and potential denial-of-service of the graphics subsystem.

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-68189. The EPSS score is 0.000180 (very low probability of exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly). The vulnerability is detectable by Nessus (plugin 279016) and Qualys (IDs 6031981, 6032019), indicating scanner coverage for patch compliance purposes.

The fix is available as a kernel patch in the stable tree, with commits 9674c4cb2fe62727a2e4d3f66065ab949dfa61be and c34e08ba6c0037a72a7433741225b020c989e4ae on kernel.org (kernel.org patch 1, kernel.org patch 2). Users running Linux kernels with the MSM DRM driver on Qualcomm Adreno GPU hardware should apply the relevant stable kernel update. As a workaround, avoiding IRIS video playback on affected hardware may reduce the likelihood of triggering the WARNING, but upgrading to a patched kernel version is the recommended remediation.