CVE-2025-68252: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68252 is a memory leak vulnerability in the Linux kernel's misc/fastrpc subsystem, specifically in the fastrpc_map_lookup function. The flaw occurs because dma_buf_get is called to obtain a reference to a DMA buffer object for comparison, but that reference is never released upon function return, causing a dma_buf object leak. The vulnerability was published on December 16, 2025, and affects multiple stable Linux kernel versions. Feedly estimates the severity as Medium, with an EPSS score of 0.00018 (Feedly, ENISA EUVD).

The root cause is a missing dma_buf_put() call in fastrpc_map_lookup (CWE-401: Missing Release of Memory after Effective Lifetime). When the function calls dma_buf_get() to retrieve a reference to a DMA buffer for comparison against existing maps, it increments the buffer's reference count but never decrements it before returning — regardless of whether a matching map is found or not. This results in a gradual memory leak each time the lookup function is invoked. The fix, applied across multiple stable kernel branches, adds a dma_buf_put() call before all return paths to ensure the temporarily acquired reference is properly released (ENISA EUVD, Kernel Patch 1).

The primary impact of this vulnerability is a kernel-level memory leak in the fastrpc driver, which is used for offloading computation to Qualcomm DSPs (Digital Signal Processors) on Android and embedded Linux devices. Repeated triggering of the leak can gradually exhaust kernel memory, potentially leading to system instability or denial of service. There is no direct evidence of confidentiality or integrity impact, and the vulnerability does not appear to enable privilege escalation or remote code execution (Feedly, ENISA EUVD).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include Linux 6.1.158+, 6.6.115+, 6.12.56+, and 6.17.6+, with corresponding commits applied to each stable tree. Administrators should update to a patched kernel version as soon as possible. On systems where the fastrpc driver is not required, disabling or blacklisting the fastrpc kernel module (modprobe -r fastrpc) can serve as a temporary workaround to eliminate exposure (ENISA EUVD, Kernel Patch 1).