CVE-2025-68296: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68296 is a race condition vulnerability in the Linux kernel's framebuffer console (fbcon) and VGA switcheroo subsystem that can lead to an out-of-bounds (OOB) memory access and denial of service. The flaw exists because vga_switcheroo_client_fb_set() is called before register_framebuffer() completes, leaving struct fb_info.node set to -1 — an illegal value used as an array index in set_con2fb_map(). It affects Linux kernel versions from 2.6.34 onward, with patches available in kernel 6.12.61, 6.17.11, and 6.18. The vulnerability was disclosed on December 16, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-362) combined with an out-of-bounds array access (CWE-125) in the Linux kernel's DRM/fbcon/VGA switcheroo initialization path. When VGA switcheroo triggers fbcon_remap_all() during a graphics output switch, it reads struct fb_info.node to index into an array; however, if vga_switcheroo_client_fb_set() is called before register_framebuffer() sets this field, the node value remains -1, causing an illegal array access. The fix moves vga_switcheroo_client_fb_set() under fbcon_fb_registered(), which is already called from within register_framebuffer() while holding the console lock, serializing the two operations. Only drivers supporting VGA switcheroo — amdgpu, i915, nouveau, and radeon — are affected (Red Hat Bugzilla).

Successful exploitation allows a local attacker with low privileges to trigger a denial of service through system instability or a kernel crash caused by the out-of-bounds memory access. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS availability impact: High). Affected systems are those running Linux kernels with AMD (amdgpu/radeon), Intel (i915), or Nouveau graphics drivers that support VGA switcheroo (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term (Red Hat Advisory).

The Linux kernel community has released patches addressing this vulnerability in stable kernel versions 6.12.61, 6.17.11, and 6.18. Downstream distributions including Ubuntu (USN-8094-1 through USN-8094-5, USN-8152-1), SUSE, and Oracle Linux have also issued updated kernel packages. Administrators should update to the latest patched kernel version for their distribution and prioritize systems using AMD, Intel (i915), Nouveau, or Radeon graphics drivers. Limiting local user access on affected systems is a secondary mitigation until patching is complete (Red Hat Advisory, Ubuntu USN-8094-1).