CVE-2025-68205: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68205 is a NULL pointer dereference vulnerability in the Linux kernel's ALSA HDA/HDMI subsystem, specifically in the nvhdmi-mcp driver. It was introduced by a copy-paste error during a refactoring of the HDMI codec driver code, where the build_controls and build_pcms operation callbacks were swapped. This causes a NULL dereference because the PCM instance has not been initialized when build_controls is called. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from commit ad781b550f9a up to (but not including) the fixed commits. It carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.018% (Feedly, CVE.org).

The root cause is a copy-paste error (CWE-476: NULL Pointer Dereference) introduced during the restructuring and splitting of the HDMI codec driver code in the Linux kernel's ALSA HDA subsystem. After the refactor, each HDMI codec driver was expected to define its own build_controls and build_pcms ops; however, in the nvhdmi-mcp driver, these two callbacks were accidentally swapped. Because both callbacks share the same function signature, the compiler did not detect the error. At probe time, when build_controls is invoked before PCM instances are initialized, the swapped callback attempts to dereference a NULL PCM pointer, triggering a kernel NULL dereference. The fix involves correcting the op table entries to reference the proper callbacks (Feedly, ENISA EUVD).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference during the probing of the nvhdmi-mcp HDMI audio driver, which can result in a kernel panic or system crash (denial of service). The impact is limited to availability — systems with NVIDIA MCP-based HDMI audio hardware that load the affected driver may crash or become unresponsive during driver initialization. There is no known confidentiality or integrity impact, and the vulnerability is not exploitable for privilege escalation or remote code execution based on current information (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-68205. The vulnerability is only triggerable locally during driver probe on systems with affected NVIDIA MCP HDMI audio hardware. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The vulnerability is fixed in Linux kernel stable commits d2aed6fac114 (one stable branch) and 82420bd4e17b (another stable branch), as well as in kernel version 6.17.9 and the 6.18 release. Users should update to a patched kernel version that includes these fixes. As a temporary workaround on affected systems, blacklisting the snd-hda-codec-nvhdmi or related NVIDIA HDMI audio kernel module can prevent the NULL dereference from occurring during boot, at the cost of losing HDMI audio functionality (Feedly, ENISA EUVD).