CVE-2025-68293: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68293 is a NULL pointer dereference vulnerability in the Linux kernel's mm/huge_memory subsystem, triggered during huge page (THP) folio splitting. It was introduced by commit c010d47f107f ("mm: thp: split huge page to any lower order pages"), which added an early check on mapping->flags without first verifying that mapping is non-NULL. For shmem folios in the swap cache and truncated folios, the mapping pointer can be NULL, causing a kernel NULL pointer dereference. The vulnerability was disclosed on December 16, 2025, and affects Linux kernel versions from 6.9 up to the patched releases. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in the mm/huge_memory.c code path responsible for splitting transparent huge pages (THP) into lower-order pages. Commit c010d47f107f introduced an early check that reads mapping->flags to determine the folio's order before proceeding with the split; however, it did not guard against the case where mapping itself is NULL. This condition arises for shmem folios residing in the swap cache or for truncated folios, where the mapping pointer is legitimately NULL. The fix moves the mapping != NULL check before any access to mapping->flags. Exploitation requires local access with low privileges and high attack complexity, as the attacker must trigger the specific code path involving a NULL-mapped folio during a THP split operation (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes a kernel NULL pointer dereference, which typically results in a kernel panic (system crash), leading to a denial of service. Given the CVSS score reflects high confidentiality, integrity, and availability impacts, there is also theoretical potential for privilege escalation or memory corruption depending on kernel configuration and exploit sophistication, though no such exploitation has been publicly demonstrated. The vulnerability affects the local system running a vulnerable Linux kernel version, with no direct network-based attack surface (Red Hat CVE).

The Linux kernel has been patched in stable releases 6.12.61, 6.17.11, and 6.18. The fix is also included in the mainline kernel. Downstream distributions including Ubuntu (USN-8094-1 through USN-8094-5, USN-8152-1) and Oracle Linux have released updated kernel packages. Users should update to a patched kernel version as soon as possible. No configuration-based workaround is available; upgrading the kernel is the only remediation (Ubuntu USN-8094-1, Red Hat Bugzilla).