CVE-2025-68204: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68204 is a resource leak vulnerability in the Linux kernel's ARM SCMI (System Control and Management Interface) power domain provider (pmdomain: arm: scmi). When of_genpd_add_provider_onecell() fails during probe initialization, previously created generic power domains (genpd) are not properly released, resulting in a memory leak and potential kernel crash during the genpd_debug_add() phase at boot time. The vulnerability was published on December 16, 2025, and affects Linux kernel versions prior to 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.118, 6.12.59, and 6.17.9, as well as Microsoft Azure Linux 3 kernel version 6.6.117.1-1. It carries a CVSS v3.1 base score of 6.2 (Medium) with availability impact only (Feedly, Microsoft MSRC).

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the ARM SCMI power domain provider's probe function. When of_genpd_add_provider_onecell() fails, the code returns an error without unwinding the previously initialized generic power domains, leaving them allocated in kernel memory. This dangling state causes a kernel paging fault later when genpd_debug_add() attempts to iterate over the leaked domain structures during the initcall sequence, as demonstrated by the crash at virtual address fffffffffffffc70 on ARM Juno hardware running kernel 6.18.0-rc1. The fix adds proper error-path unwinding to release all initialized domains before returning from probe on failure (Feedly).

Exploitation of this vulnerability results in a kernel panic ("Unable to handle kernel paging request") during early boot initialization, causing a complete denial of service — the system fails to boot successfully. There is no confidentiality or integrity impact; the sole consequence is high availability impact affecting the entire system. Systems using ARM SCMI-based power domain providers (e.g., ARM Juno development platforms and similar embedded/server hardware) are at risk of being rendered unbootable if the probe failure condition is triggered (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is triggered locally during kernel boot when the SCMI power domain provider probe fails — a condition that may arise from hardware faults, misconfiguration, or driver initialization errors rather than deliberate attacker action. The EPSS score is 0.000240 (very low probability of exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

• Logs: Kernel panic messages containing Unable to handle kernel paging request at virtual address fffffffffffffc70 in system logs or serial console output.
• Logs: Kernel call trace referencing genpd_debug_add, genpd_debug_init, do_one_initcall, and kernel_init in the boot log.
• Logs: Probe failure messages from the ARM SCMI power domain driver (e.g., of_genpd_add_provider_onecell returning an error) in dmesg output.
• Process: System halts or reboots during early boot (PID 1, swapper/0) before userspace initialization completes.

Apply the patched Linux kernel versions: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.118, 6.12.59, or 6.17.9. Microsoft has released an update for Azure Linux 3 addressing kernel version 6.6.117.1-1. Ubuntu has issued security notices USN-8096-1, USN-8096-2, USN-8096-3, and USN-8116-1 covering this vulnerability, and Debian has published a LTS advisory (DLA-4436-1). No configuration-based workaround is available; kernel patching is the only remediation. Systems not using ARM SCMI power domain providers are not affected (Feedly, Microsoft MSRC).