CVE-2025-68196: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68196 is a use-after-free/crash vulnerability in the Linux kernel's DRM AMD display subsystem (drm/amd/display) caused by improper handling of stream pointers during Link Training (LT) automation. The flaw allows the LT automation code path to reference current_state and call dc_update_planes_and_stream, which may clobber current_state, leading to a kernel crash. It was published on December 16, 2025, and affects Linux kernel versions from the initial commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) up to the patched commits. The Feedly estimate categorizes this as Medium severity, with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is a race/ordering issue (related to CWE-416: Use After Free or CWE-476: NULL Pointer Dereference) in the AMD display driver's LT automation logic, where the code iterates over streams by referencing current_state directly. When dc_update_planes_and_stream is called during this iteration, it can overwrite or invalidate current_state, causing subsequent dereferences to access freed or corrupted memory and resulting in a kernel panic. The fix caches the relevant stream pointers before beginning the LT automation loop, so the iteration no longer depends on the live current_state pointer. Patches are referenced in the stable kernel tree at commits 9ecd238e8230e83a5c5436fd2261da4518f5c979 and f5b69101f956f5b89605a13cb15f093a7906f2a1 (Kernel Git, Kernel Git).

Successful triggering of this vulnerability results in a kernel crash (denial of service) on systems running affected Linux kernels with AMD display hardware. The crash occurs in kernel space, meaning the entire system becomes unavailable until rebooted. There is no known direct path to privilege escalation or data exfiltration from this vulnerability; the primary impact is availability loss (Feedly, EUVD).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-68196. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access or the ability to trigger LT automation on an AMD GPU-equipped system (Feedly).

Apply the upstream Linux kernel patches that fix this issue: stable commit 9ecd238e8230e83a5c5436fd2261da4518f5c979 (targeting kernel 6.17.8) and f5b69101f956f5b89605a13cb15f093a7906f2a1 (targeting kernel 6.18). Users should update to Linux kernel 6.17.8 or 6.18 (or later) as soon as their distribution makes these patches available. No configuration-based workaround is known; the only remediation is applying the kernel patch (Kernel Git, Kernel Git).