CVE-2025-68245: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68245 is a memory leak and improper cleanup vulnerability in the Linux kernel's netpoll subsystem, caused by incorrect reference count handling during netpoll teardown. The flaw was introduced by commit efa95b01da18 ("netpoll: fix use after free"), which incorrectly set dev->npinfo to NULL while ignoring the reference count, leading to incomplete cleanup of shared npinfo structures and SKB pool leaks when multiple netpoll instances share a single NIC. It was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. No CVSS score has been officially assigned at this time (Feedly, CVE Feed).

The root cause is improper reference count management (CWE-911: Improper Update of Reference Count) in the Linux kernel's net/core/netpoll.c. When the first of multiple netpoll instances sharing a NIC cleans up, it unconditionally calls RCU_INIT_POINTER(np->dev->npinfo, NULL) without checking whether the reference count (npinfo->refcnt) has reached zero, prematurely nullifying the shared pointer. Subsequent netpoll instances then find np->dev->npinfo already NULL during their own cleanup, causing ndo_netpoll_cleanup() to be skipped and the SKB pool to remain unfreed, resulting in memory leaks. Fixes were applied across multiple stable kernel branches via commits 4afd4ebbad52, 8e6a50edad11, 9a51b5ccd1c7, 9b0bb18b4b9d, and 49c8d2c1f94c (Feedly).

The primary impact of CVE-2025-68245 is a kernel memory leak affecting availability and system stability. When multiple netpoll consumers share a network interface, improper cleanup leads to leaked npinfo structures and unfreed SKB pool buffers, which can gradually exhaust kernel memory over time. This is a local, kernel-level issue with no direct confidentiality or integrity impact, but sustained memory exhaustion could degrade or crash affected systems (Feedly, CVE Feed).

The Linux kernel maintainers have released fixes across multiple stable branches. Administrators should update to patched kernel versions incorporating commits 4afd4ebbad52aa146838ec23082ba393e426a2bb, 8e6a50edad11e3e1426e4c29e7aa6201f3468ac2, 9a51b5ccd1c79afec1c03a4e1e6688da52597556, 9b0bb18b4b9dc017c1825a2c5e763615e34a1593, or 49c8d2c1f94cc2f4d1a108530d7ba52614b874c2 as appropriate for their kernel branch. Downstream distributions including Debian (DLA-4436-1), Ubuntu (USN-8096-1/2/3/5), SUSE, Oracle Linux 8, and Amazon Linux 2 (ALAS2KERNEL-5.10-2026-112) have issued advisories and updated packages (Debian LTS, Ubuntu USN-8096-1, Amazon Linux).