CVE-2025-68228: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68228 is a NULL pointer dereference vulnerability in the Linux kernel's DRM (Direct Rendering Manager) plane subsystem, specifically in the create_in_format_blob() function. The function could return NULL in failure cases instead of a proper error pointer, causing a kernel oops (crash) when the caller attempts to dereference the returned value. The vulnerability was published on December 16, 2025, and affects Linux kernel versions in the range introduced by commit 0d6dcd741c26 up to (but not including) the fix commits. Patched versions include Linux 6.17.10 and 6.18. The CVSS base score is 0.0 as assessed by ENISA, reflecting its limited exploitability profile (Feedly, EUVD).

The root cause is an improper return value in create_in_format_blob() within the Linux kernel's drm/plane subsystem (CWE-476: NULL Pointer Dereference). The function is designed to return either a valid pointer or an error pointer (via ERR_PTR()), but in certain failure paths it returned NULL instead. The caller does not check for NULL — only for error pointers — and thus proceeds to dereference the NULL pointer, triggering a kernel oops. The fix ensures that all failure paths return proper error values using ERR_PTR() rather than NULL (Feedly, Linux Kernel Patch 1, Linux Kernel Patch 2).

Successful triggering of this vulnerability causes a kernel oops (crash), resulting in a denial of service on the affected system. Because the flaw resides in the DRM subsystem, it is most likely to be triggered during graphics/display plane initialization or format blob creation, potentially affecting systems with DRM-managed display hardware. There is no evidence of confidentiality or integrity impact; the primary consequence is system availability loss (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability. The fix is included in Linux kernel 6.17.10 and 6.18, corresponding to commits 860f93f4fce1e733b8a2474f6bfa153243d775f3 and cead55e24cf9e092890cf51c0548eccd7569defa. Ubuntu has issued multiple security notices (USN-8094-1 through USN-8094-5, and USN-8152-1) addressing this CVE. Users should update their Linux kernel packages to the patched versions provided by their distribution (Ubuntu USN-8094-1, Ubuntu USN-8152-1, Linux Kernel Patch 1).