CVE-2025-68229: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68229 is a NULL pointer dereference vulnerability in the Linux kernel's SCSI target tcm_loop driver, specifically in the tcm_loop_tpg_address_show() function. When the allocation of tl_hba->sh (the SCSI host structure) fails during tcm_loop_driver_probe(), a subsequent read of the tpg_address configfs attribute dereferences the uninitialized pointer, causing a kernel segfault (oops). The vulnerability was published on December 16, 2025, and affects Linux kernel versions from commit 2628b352c3d4 up to the respective patched stable releases. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access with low privileges (Feedly, Microsoft MSRC).

The root cause is a missing NULL check (CWE-476: NULL Pointer Dereference) in tcm_loop_tpg_address_show(). When scsi_host_alloc() fails inside tcm_loop_driver_probe(), tl_hba->sh is left as NULL. If a local user subsequently reads the tpg_address attribute via the configfs interface (e.g., cat /sys/kernel/config/target/loopback/.../tpg_address), the kernel dereferences the NULL pointer at offset 0x194, triggering a BUG: kernel NULL pointer dereference oops. The fix adds a NULL check for tl_hba->sh before dereferencing it in the show function. The attack vector is local, requires low privileges, and no user interaction, making it exploitable by any unprivileged user with access to the configfs interface on an affected system (Feedly).

Successful exploitation causes an immediate kernel crash (denial of service), requiring a system reboot to recover. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The affected scope is any Linux system running a vulnerable kernel version with the tcm_loop module loaded and configfs accessible to low-privileged users, including Azure Linux 3 (kernel 6.6.117.1-1) and other distributions shipping unpatched kernel branches (Feedly, Microsoft MSRC).

1. Prerequisite: Obtain a local, low-privileged account on a Linux system running a vulnerable kernel version (e.g., kernel 6.6.x prior to 6.6.118) with the tcm_loop kernel module loaded.
2. Trigger allocation failure: The tl_hba->sh NULL condition arises when scsi_host_alloc() fails during tcm_loop_driver_probe() — this may occur under memory pressure or specific hardware/driver conditions.
3. Access configfs attribute: As a low-privileged user, read the tpg_address attribute of a tcm_loop target portal group via the configfs filesystem, e.g., cat /sys/kernel/config/target/loopback/<wwn>/tpgt_<id>/tpg_address.
4. Trigger kernel crash: The kernel executes tcm_loop_tpg_address_show(), dereferences the NULL tl_hba->sh pointer at offset 0x194, and generates a kernel oops/segfault, crashing the system (Feedly).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing BUG: kernel NULL pointer dereference, address: 0000000000000194 and RIP: 0010:tcm_loop_tpg_address_show immediately preceding a system crash.
• Logs: Kernel oops trace showing call stack: configfs_read_iter → vfs_read → ksys_read → tcm_loop_tpg_address_show.
• Logs: Prior message Unable to allocate struct scsi_host in kernel logs, indicating the precondition for the crash.
• Process: Unexpected system reboots or kernel panics on systems with the tcm_loop module loaded.
• File System: Repeated or unusual access to /sys/kernel/config/target/loopback/*/tpg_address by non-root users visible in audit logs (Feedly).

Apply the upstream kernel patches, which add a NULL check for tl_hba->sh before dereferencing it in tcm_loop_tpg_address_show(). Patched versions include: 6.6.118, 6.12.60, 6.17.10, 5.4.302, 5.10.247, 5.15.197, 6.1.159, and 6.18. Distribution-specific updates are available from Ubuntu (USN-8096-1/2/3/5, USN-8094-2/3/4/5, USN-8152-1), Debian (DLA-4436-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2025-096, ALAS2KERNEL-5.10-2026-112), and Oracle Linux. As a workaround where patching is not immediately possible, restrict local user access to the configfs interface and prevent loading of the tcm_loop module (echo 'install tcm_loop /bin/false' >> /etc/modprobe.d/blacklist.conf) (Feedly, Ubuntu USN-8096-1).