CVE-2025-68237: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68237 is an integer overflow vulnerability in the Linux kernel's mtdchar driver affecting the read/write ioctl handlers. The flaw arises because the req.start variable (a u64 value supplied by the user) can reach U64_MAX, and while req.len is capped at U32_MAX, their addition can still overflow. It was published on December 16, 2025, and affects Linux kernel versions prior to the patched stable releases (6.1.159, 6.6.118, 6.12.60, 6.17.10, and 6.18). Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.117.1-1 is also listed as an affected product. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Feedly, Microsoft MSRC).

The root cause is an integer overflow (CWE-190) in the mtdchar driver's ioctl handling code. When processing read/write ioctl requests, the kernel accepts req.start and req.len as u64 values from userspace. Although req.len is masked to cap it at U32_MAX, req.start is unconstrained and can be set to values approaching U64_MAX. Adding these two values together can wrap around, producing an incorrect result that bypasses bounds checks and leads to out-of-bounds memory access. The fix replaces the plain addition with check_add_overflow() to detect and reject overflowing inputs. The attack vector is local, requires low privileges, and no user interaction (Feedly, Microsoft MSRC).

Successful exploitation allows a local, low-privileged attacker to cause memory corruption by reading from or writing to unauthorized kernel memory locations. This can result in unauthorized disclosure of sensitive data (confidentiality breach), modification of kernel memory (integrity breach), and system crashes or denial of service (availability breach). The CVSS score reflects high impact across all three pillars, and exploitation could potentially be leveraged for local privilege escalation (Feedly).

The Linux kernel project has released patches across multiple stable branches: versions 6.1.159, 6.6.118, 6.12.60, 6.17.10, and 6.18 all contain the fix. Microsoft has also issued guidance for its Azure Linux 3 kernel package (azl3_kernel_6.6.117.1-1). Ubuntu has released security notices USN-8094-1 through USN-8094-5 and USN-8152-1 addressing this issue, and Debian has issued a LTS advisory. Administrators should update to the appropriate patched kernel version for their distribution as soon as possible. As an interim measure, restricting local user access to MTD character devices (e.g., via file permissions or access control policies) can reduce the attack surface (Microsoft MSRC, Ubuntu USN-8094-1, Debian LTS).