CVE-2025-68198: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68198 is a NULL pointer dereference vulnerability in the Linux kernel's crashkernel memory reservation handling, specifically in the __crash_shrink_memory function. When crashkernel is configured with a high reservation (e.g., crashkernel=200M,high) and subsequently shrunk below the low crashkernel reservation threshold via /sys/kernel/kexec_crash_size, the kernel fails to update the correct crashkernel resource object (crashk_res or crashk_low_res), resulting in invalid resource objects and a kernel crash on a second shrink operation. The vulnerability was published on December 16, 2025, and affects the Linux kernel, including Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.117.1-1. It carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC).

The root cause is improper resource object selection during crashkernel memory shrinking (CWE-476: NULL Pointer Dereference). When a system uses crashkernel=<size>,high, two resource objects are created — one for high memory (crashk_res) and one for low memory (crashk_low_res). When the user writes a reduced size to /sys/kernel/kexec_crash_size that falls below the low reservation threshold, the kernel's __crash_shrink_memory function incorrectly updates the wrong resource object, leaving the other in an invalid state. A subsequent shrink operation then attempts to call release_resource() on the invalidated object, triggering a NULL pointer dereference at address 0x0000000000000038 in __release_resource, causing a kernel panic. Exploitation requires local access and low privileges (write access to the sysfs interface) (Microsoft MSRC).

Successful exploitation causes a kernel NULL pointer dereference and complete system crash (kernel panic), resulting in a denial of service. Additionally, after the first erroneous shrink operation, /proc/iomem displays incorrect crashkernel memory reservation values, undermining the accuracy of kernel crash dump memory visibility. The impact is limited to availability — there is no confidentiality or integrity impact — and is constrained to systems where users actively modify crashkernel parameters at runtime via sysfs (Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges (the ability to write to /sys/kernel/kexec_crash_size), limiting the attack surface to authenticated local users or processes on affected systems (Microsoft MSRC).

1. Gain local access: Obtain a local user account on a Linux system configured with crashkernel=<size>,high (e.g., crashkernel=200M,high), which creates both high and low crashkernel memory reservations visible in /proc/iomem.
2. Verify configuration: Confirm the dual reservation by reading /proc/iomem and checking for two "Crash kernel" entries (one for low memory, one for high memory).
3. First shrink operation: Write a value below the low crashkernel reservation threshold to the sysfs interface: echo 52428800 > /sys/kernel/kexec_crash_size (e.g., shrink to 50MB). Observe that /proc/iomem still shows the original low reservation size due to the incorrect resource object being updated.
4. Second shrink operation: Write a further reduced value: echo 41943040 > /sys/kernel/kexec_crash_size (e.g., shrink to 40MB). This triggers release_resource() on the now-invalid resource object, causing a NULL pointer dereference in __release_resource and a kernel panic/crash.

• Logs: Kernel oops messages in /var/log/kern.log or dmesg containing BUG: kernel NULL pointer dereference, address: 0000000000000038 and a call trace including __release_resource, release_resource, __crash_shrink_memory, crash_shrink_memory, kexec_crash_size_store, and kernfs_fop_write_iter.
• File System / sysfs: Repeated or sequential writes to /sys/kernel/kexec_crash_size with decreasing values, particularly on systems using crashkernel=<size>,high boot parameters.
• Process: Audit log entries (if auditd is configured) showing write syscalls to /sys/kernel/kexec_crash_size by non-root or unexpected users.
• Memory: /proc/iomem showing a "Crash kernel" entry that does not reflect the expected size after a shrink operation, indicating the resource object was not correctly updated.

A patch is available in the upstream Linux kernel and in Microsoft's Azure Linux 3 package azl3_kernel_6.6.117.1-1. The fix ensures the correct crashkernel resource object (crashk_res or crashk_low_res) is selected and updated when shrinking crashkernel memory, preventing invalid resource states and subsequent kernel crashes. As a temporary workaround, restrict write access to /sys/kernel/kexec_crash_size via file permissions or SELinux/AppArmor policies to limit runtime modification of crashkernel parameters to authorized administrators only. Upstream kernel patches are referenced at the kernel stable git repository (Microsoft MSRC).