CVE-2025-68286: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68286 is a NULL pointer dereference vulnerability in the Linux kernel's AMD display driver (drm/amd/display) module, specifically within the dc_stream_get_scanoutpos function. It can be triggered during display-related operations when both an eDP panel and a DisplayPort (DP) monitor are connected simultaneously, potentially causing a kernel oops/panic. The vulnerability was published on December 16, 2025, and affects the Linux kernel, including distributions such as Ubuntu, Debian, Oracle Linux, and Microsoft's Azure Linux 3 kernel (azl3_kernel prior to 6.6.117.1-1). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is a missing NULL pointer check (CWE-476) in the dc_stream_get_scanoutpos function of the amdgpu kernel driver's display subsystem. When the IGT test kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic subtest is run with both an eDP panel and a DP monitor connected, a NULL pointer dereference occurs at address 0x0000000000000000, triggering a kernel page fault (#PF: supervisor read access in kernel mode). The attack vector is local (requiring low-privileged access to trigger display operations), and exploitation requires the specific hardware configuration of simultaneous eDP and DP display connections. The fix involves adding a NULL check before accessing the pointer in dc_stream_get_scanoutpos, with the patch cherry-picked from commit 621e55f1919640acab25383362b96e65f2baea3c (Red Hat CVE).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel oops or panic and a system crash, constituting a denial-of-service condition. There is no impact on confidentiality or integrity — only availability is affected. Systems running AMD graphics hardware with the amdgpu driver and using both eDP and DP displays concurrently are at risk of unexpected shutdowns or system instability (Red Hat CVE, Microsoft MSRC).

The primary remediation is to update to a patched Linux kernel version that includes the fix (commit 621e55f1919640acab25383362b96e65f2baea3c). Vendor-specific updates are available from Red Hat, Ubuntu (USN-8094-1 through USN-8094-5, USN-8096-2, USN-8096-3, USN-8116-1, USN-8152-1), Debian (DLA-4436-1), Oracle Linux, and Microsoft (Azure Linux 3 kernel ≥ 6.6.117.1-1). As a temporary workaround, avoid simultaneously connecting eDP panels and DP monitors on affected AMD graphics systems until the patch is applied, and monitor system logs for display-related kernel errors (Red Hat CVE, Microsoft MSRC, Ubuntu USN-8094-1).