CVE-2025-68309: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68309 is a NULL pointer dereference vulnerability in the Linux kernel's PCI/AER (Advanced Error Reporting) subsystem. It occurs when kzalloc(GFP_KERNEL) returns NULL and subsequent accesses to aer_info->xxx fields are not guarded, resulting in a kernel panic. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from the initial commit (1da177e4c3f4) up to the patched commits in stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing NULL check after a kzalloc(GFP_KERNEL) call in the PCI/AER error reporting code path, classified as CWE-476 (NULL Pointer Dereference). When memory allocation fails and returns NULL, the kernel code proceeds to dereference aer_info->xxx fields without validation, triggering a kernel panic. The attack vector is local, requiring low privileges and no user interaction. Patches were applied in two upstream stable commits: 6618243bcc3f and 0a27bdb14b02, targeting kernel versions up to 6.17.8 and 6.18 respectively (Red Hat Bugzilla, ENISA EUVD).

Successful exploitation causes a kernel panic, resulting in a complete denial of service (system crash) on the affected host. The impact is limited to availability — there is no confidentiality or integrity impact. A local low-privileged user who can trigger the PCI/AER code path under memory pressure conditions could crash the system, potentially disrupting all services running on it (Red Hat Advisory).

Apply the upstream kernel patches included in Linux kernel 6.17.8 and 6.18, which add a NULL check after the kzalloc() call in the PCI/AER subsystem (commits 6618243bcc3f and 0a27bdb14b02). Users should update to a patched kernel version as provided by their Linux distribution. As a secondary measure, restricting local user access to minimize the attack surface is advisable until patching is complete (Red Hat Bugzilla, Red Hat Advisory).