CVE-2025-68235: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68235 is a memory leak vulnerability in the Linux kernel's nouveau/firmware module, specifically in the handling of nvkm_falcon_fw::boot. The nvkm_falcon_fw::boot data structure is allocated during initialization but is never properly deallocated, resulting in a kmemleak warning and potential kernel memory exhaustion. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from 6.2 up to the patched releases. It carries a CVSS v3.1 base score of 7.1 (High), requiring only local access with low privileges (Microsoft MSRC, Feedly).

The root cause is a missing kfree() call for the nvkm_falcon_fw::boot memory allocation within the Linux kernel's nouveau graphics driver firmware subsystem (CWE-401: Missing Release of Memory after Effective Lifetime). When the nouveau driver initializes firmware for NVIDIA Falcon microcontrollers, it allocates memory for the boot field of the nvkm_falcon_fw structure but never frees it upon cleanup, causing a persistent kernel memory leak. An attacker with local, low-privileged access can repeatedly trigger the affected code path — for example, by loading and unloading the nouveau driver or repeatedly invoking firmware initialization — to progressively exhaust kernel memory. Patches are available as commits to the stable kernel tree (Linux Kernel Git, Linux Kernel Git).

A local attacker with low privileges can exploit this vulnerability to cause denial of service through progressive kernel memory exhaustion, leading to system instability, performance degradation, and potential system crashes. The integrity impact is rated High due to possible corruption of kernel memory structures as available memory is depleted, while confidentiality is not directly affected. Systems running the nouveau graphics driver — particularly workstations, desktops, or servers with NVIDIA GPUs using the open-source driver — are at risk of availability loss (Microsoft MSRC, Feedly).

Update to a patched Linux kernel version: 6.18, 6.17.10, 6.12.60, or 6.6.118. Microsoft has also released a patch for the Azure Linux 3 kernel package azl3_kernel_6.6.117.1-1. Ubuntu users should apply the updates provided in security notices USN-8094-1 through USN-8094-5 and USN-8152-1. As a workaround where patching is not immediately possible, restrict local user access to systems with NVIDIA GPUs using the nouveau driver, and consider blacklisting the nouveau kernel module if the driver is not required (Microsoft MSRC, Ubuntu USN-8094-1, Ubuntu USN-8152-1).