CVE-2025-68201: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68201 is a vulnerability in the Linux kernel's drm/amdgpu driver caused by two invalid BUG_ON() assertions that can be trivially triggered by userspace, leading to a kernel panic (denial of service). It was published on December 16, 2025, and affects Linux kernel versions prior to the patched releases 6.12.59, 6.17.9, and 6.18. No CVSS score has been assigned (base score recorded as 0.0), and the CVE status is listed as "Deferred" (Feedly, ENISA EUVD).

The root cause is the improper use of BUG_ON() macros within the drm/amdgpu kernel driver — a mechanism intended to catch internal programming errors that should never occur. Because these assertions can be reached via normal userspace-controlled inputs (e.g., through DRM ioctls or device file interactions), a local unprivileged user can craft requests that satisfy the BUG_ON() condition, triggering an immediate kernel panic. This is classified as an uncontrolled resource consumption or reachable assertion issue (related to CWE-617: Reachable Assertion). The fix removes the two offending BUG_ON() calls from the amdgpu driver code (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation allows a local, unprivileged user with access to the AMD GPU device node to crash the kernel, resulting in a complete denial of service (system reboot required). There is no evidence of confidentiality or integrity impact — the vulnerability is limited to availability. Systems running AMD GPUs with the amdgpu driver loaded are at risk, particularly multi-user environments or cloud/virtualization hosts where untrusted users have access to GPU resources (Feedly, ENISA EUVD).

1. Access: Obtain local user access on a Linux system with an AMD GPU and the amdgpu kernel driver loaded (e.g., via SSH or physical access).
2. Identify device node: Confirm the presence of the AMD GPU device node (e.g., /dev/dri/card0 or /dev/dri/renderD128) and verify read/write access.
3. Craft malicious ioctl: Send a specially crafted DRM ioctl or sequence of GPU commands via the device node that triggers one of the two invalid BUG_ON() conditions in the amdgpu driver.
4. Trigger kernel panic: The kernel evaluates the BUG_ON() condition as true, immediately halting the kernel and causing a system crash (panic), resulting in denial of service (Feedly).

• Logs: Kernel panic messages in /var/log/kern.log or dmesg output referencing BUG: or kernel BUG at within the amdgpu driver module.
• Logs: System crash/reboot events logged in /var/log/syslog or systemd journal (journalctl) with unexpected reboot timestamps.
• Process: Unusual or repeated access to /dev/dri/card* or /dev/dri/renderD* device nodes by non-GPU-application processes immediately before a crash.

The Linux kernel maintainers have released patches removing the two invalid BUG_ON() calls in the drm/amdgpu driver. Fixed versions include Linux kernel 6.12.59, 6.17.9, and 6.18 (ENISA EUVD). Users should update their kernel to one of these patched versions as soon as possible. As a temporary workaround on systems where AMD GPU functionality is not required, the amdgpu kernel module can be blacklisted (echo 'blacklist amdgpu' >> /etc/modprobe.d/blacklist.conf) to prevent loading, though this will disable GPU functionality. Restricting access to /dev/dri/ device nodes for untrusted users can also reduce exposure.