CVE-2025-68238: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68238 is a NULL pointer dereference vulnerability in the Linux kernel's MTD raw NAND Cadence controller driver (mtd: rawnand: cadence). The flaw arises because the DMA device pointer dma_dev was dereferenced before verifying that cdns_ctrl->dmac was properly initialized. It was published on December 16, 2025, and affects multiple stable Linux kernel branches. Feedly estimates the severity as Medium, with an EPSS score of approximately 0.024% (Feedly, EUVD).

The root cause is a NULL pointer dereference (CWE-476) in the Cadence raw NAND controller driver within the Linux kernel's MTD subsystem. Specifically, the variable dma_dev was assigned and used before the DMA channel (cdns_ctrl->dmac) was confirmed to be successfully acquired, meaning if DMA channel acquisition failed or was not yet complete, the subsequent dereference of dma_dev would trigger a kernel NULL pointer dereference. The fix moves the assignment of dma_dev to after the DMA channel is successfully obtained, ensuring pointer validity before use (Feedly). Patches are available across multiple stable kernel trees via the kernel stable repository (Kernel Stable).

Successful triggering of this vulnerability can cause a kernel NULL pointer dereference, leading to a kernel panic or system crash, which constitutes a denial-of-service condition. The vulnerability is local in nature, requiring the ability to interact with or load the affected NAND controller driver, and does not directly expose confidentiality or integrity of data. Systems using Cadence raw NAND controllers with DMA support are at risk of unexpected crashes during driver initialization if DMA channel acquisition fails (Feedly).

There is no public evidence of active in-the-wild exploitation of CVE-2025-68238, and no exploit code or proof-of-concept has been publicly disclosed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term (Feedly). Exploitation would require local access to a system with the affected Cadence NAND controller driver loaded.

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include Linux 5.10.247, 5.15.197, 6.1.159, 6.6.118, 6.12.60, 6.17.10, and 6.18. Debian LTS users should apply the update referenced in the Debian LTS announcement, and Ubuntu users should apply the updates provided in USN-8094-x, USN-8096-x, USN-8116-1, USN-8152-1, and related advisories (Ubuntu USN-8094-1, Debian LTS). The recommended remediation is to update the Linux kernel to a patched version; no configuration-based workaround is available beyond avoiding use of the affected Cadence NAND DMA driver on vulnerable kernel versions.