CVE-2025-68190: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68190 is a NULL pointer dereference vulnerability in the Linux kernel's drm/amdgpu/atom subsystem, specifically within the amdgpu_atom_execute_table_locked() function. The flaw arises when kcalloc() fails to allocate a workspace (WS) buffer: ectx.ws remains NULL while ectx.ws_size is set to a non-zero value, leading to a potential NULL pointer dereference in atom_get_src_int() when WS entries are accessed. It was published on December 16, 2025, and affects Linux kernel versions from the initial commit up to (but not including) the patched stable commits for the 6.12, 6.17, and 6.18 series (Feedly, EUVD). No CVSS base score has been assigned at this time.

The root cause is a missing return-value check on kcalloc() (CWE-476: NULL Pointer Dereference). In amdgpu_atom_execute_table_locked(), when the WS (workspace) size is non-zero, the code allocates a buffer via kcalloc(); if this allocation fails under memory pressure, ectx.ws is left as NULL while ectx.ws_size reflects the intended size. Subsequent calls to atom_get_src_int() that index into ectx.ws will then dereference a NULL pointer, potentially causing a kernel panic. The fix adds an explicit check for allocation failure and returns -ENOMEM to the caller (Feedly, Kernel Patch 1).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, which typically results in a kernel panic (system crash), leading to a denial of service on the affected host. The vulnerability is confined to systems with AMD GPUs using the AMDGPU driver and is triggered under low-memory conditions during ATOM table execution. There is no evidence of confidentiality or integrity impact beyond the availability loss from a system crash (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68190. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require the ability to trigger AMDGPU ATOM table execution under memory pressure conditions, which is a non-trivial precondition (Feedly).

The Linux kernel stable tree has released patches addressing this vulnerability in versions 6.12.58, 6.17.8, and 6.18 (and later). Users should update their Linux kernel to one of these patched versions. The relevant upstream commits are 35f3fb86bb01, cc9a8e238e42, and 997e28d3d00a (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3). As a temporary workaround on systems where AMDGPU is not required, disabling or blacklisting the amdgpu kernel module can eliminate exposure to this code path.