CVE-2025-68303: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68303 is a memory corruption vulnerability in the Linux kernel's Intel P-Unit IPC (Inter-Processor Communication) driver (platform/x86: intel: punit_ipc). The bug stems from incorrectly passing &punit_ipcdev (address of the pointer) instead of punit_ipcdev (the pointer itself), causing the complete() function in intel_punit_ioc() to write to a wrong memory address. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from 4.5 onward, including stable branches up to 5.15.x, 6.1.x, 6.6.x, and 6.12.x, as well as Microsoft Azure Linux (azl3_kernel_6.6.117.1-1). It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, Microsoft MSRC).

The root cause is an incorrect pointer dereference (CWE-119/CWE-787 — improper memory write) in the intel_punit_ipc driver initialization code. When registering the IPC device, the code passes &punit_ipcdev (a pointer-to-pointer) where punit_ipcdev (the pointer) was intended, so the complete(&ipcdev->cmd_complete) call in intel_punit_ioc() computes an incorrect address and writes a completion signal to an arbitrary kernel memory location. This is a local vulnerability requiring low privileges and no user interaction, with low attack complexity. Fixes were applied across multiple stable kernel branches via commits including 15d560cdf5b3, 46e9d6f54184, 3e7442c58021, a21615a4ac6f, c2ee6d389967, and 9b9c0adbc3f8 (Feedly, Microsoft MSRC).

Successful exploitation can result in high confidentiality, integrity, and availability impact on the affected system. The memory corruption caused by the erroneous write can lead to system instability, kernel panics (denial of service), data corruption, or potential privilege escalation if the corrupted memory region contains security-sensitive kernel structures. The vulnerability is confined to systems with the Intel P-Unit IPC driver loaded (typically Intel x86 platforms), and exploitation requires local access with at least low-privilege credentials (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface primarily to multi-tenant or shared environments where untrusted local users exist.

Update to a patched Linux kernel version: 5.15.197, 6.1.159, 6.6.119, 6.12.61, 6.17.11, or 6.18+. For Microsoft Azure Linux, update to a kernel version beyond azl3_kernel_6.6.117.1-1. Ubuntu users should apply the relevant USN advisories (USN-8094-x, USN-8096-x, USN-8116-1, USN-8152-1). For systems that cannot be immediately patched, restrict local user access and enforce least-privilege principles to reduce exposure. Monitor for unexpected kernel crashes or memory-related errors that may indicate exploitation attempts (Feedly, Microsoft MSRC, Ubuntu USN-8094-1).