CVE-2025-68249: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68249 is a Linux kernel vulnerability in the MOST USB driver (most/usb/hdm_probe) where put_device() is called on an uninitialized device structure during an early error path. Specifically, the hdm_probe() function can jump to the err_free_mdev label before device_initialize() has been called on &mdev->dev, causing kref_put() to operate on an uninitialized kobject and triggering a kernel WARN. The vulnerability was published on December 16, 2025, and affects the Linux kernel from the introduction of the buggy code (commit 97a6f772f36b) through multiple stable branches. Fixed versions include Linux 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.17.6, and 6.18. The CVSS estimate is Medium severity with an EPSS score of 0.024% (Feedly, ENISA EUVD).

The root cause is improper resource management (CWE-908: Use of Uninitialized Resource) in the hdm_probe() function of the Linux kernel's MOST USB host driver module. When an early error occurs before device_initialize(&mdev->dev) is called, the error-handling path incorrectly invokes put_device(&mdev->dev), which internally calls kref_put(&kobj->kref, kobject_release) on a kobject that was never initialized — only kmalloc'd. The fix replaces the put_device() call in this pre-initialization path with a direct kfree(mdev), which is the correct release mechanism at that stage (Feedly, ENISA EUVD). Exploitation would require the ability to trigger the early error path in hdm_probe(), typically by attaching a MOST USB device that causes probe failure.

The primary impact is a kernel warning (WARN) and potential memory corruption or undefined behavior due to operating on an uninitialized kobject, which could lead to system instability or a kernel panic (denial of service). Because the affected code path is in a USB device probe function, the impact is generally limited to local availability — a malicious or malformed USB device could trigger the condition. There is no known direct path to privilege escalation or data exfiltration from this vulnerability alone (Feedly, ENISA EUVD).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution for CVE-2025-68249. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Triggering the bug requires physical or privileged access to attach a MOST USB device that causes a probe failure, significantly limiting the attack surface (Feedly).

Update the Linux kernel to a patched stable version: 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.17.6, or 6.18 and later. Distribution-specific kernel updates from vendors such as Debian, Ubuntu, Red Hat, and SUSE should be applied as they become available. As a workaround, restricting physical USB access or blacklisting the most_usb kernel module (modprobe -r most_usb) on systems that do not use MOST USB devices can prevent exposure (ENISA EUVD, Feedly).