CVE-2025-68233: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68233 is a memory leak vulnerability in the Linux kernel's DRM Tegra driver, specifically within the host1x_memory_context_alloc() function, which calls get_task_pid() but omits the corresponding put_pid() call, causing a PID reference leak. It affects Linux kernel versions prior to 6.1.159, 6.6.118, 6.12.60, 6.17.10, and 6.18, as well as Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.117.1-1. The vulnerability was published on December 16, 2025, with patches released the same day. It carries a CVSS v3.1 base score of 6.2 (Medium) (Microsoft MSRC, EUVD).

The root cause is a missing resource release (CWE-401: Missing Release of Memory after Effective Lifetime) in the drm/tegra subsystem of the Linux kernel. When host1x_memory_context_alloc() calls get_task_pid() to obtain a PID reference, it does not call put_pid() before returning, because the function does not take ownership of the PID. This results in a kernel memory leak each time the code path is exercised. The fix, contributed with input from NVIDIA's Mikko Perttunen, adds the missing put_pid() call to properly release the reference (Microsoft MSRC, EUVD).

Successful exploitation causes kernel memory exhaustion through repeated triggering of the memory leak, leading to system instability or a complete system crash (denial of service). There is no confidentiality or integrity impact — the vulnerability is limited to availability. The attack requires only local access with no special privileges, making it accessible to any unprivileged local user on affected systems (Microsoft MSRC).

Upgrade to a patched Linux kernel version: 6.1.159, 6.6.118, 6.12.60, 6.17.10, or 6.18 and later. Microsoft has released a patch for the affected Azure Linux 3 kernel package (azl3_kernel_6.6.117.1-1) as of December 16, 2025. Ubuntu users should apply the updates addressed in USN-8094-1 through USN-8094-5 and USN-8152-1. Debian LTS users should refer to DLA-4436-1. As a compensating control, restrict local user access to systems running the Tegra DRM driver and monitor kernel memory usage for signs of gradual exhaustion (Microsoft MSRC, Ubuntu USN-8094-1, Debian LTS).