CVE-2025-68311: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68311 is a Linux kernel vulnerability in the tty: serial: ip22zilog driver that causes a kernel oops (panic) due to a missing device pointer in struct uart_port.dev. After commit 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM"), serial drivers are required to provide a device reference in struct uart_port.dev; the ip22zilog driver failed to comply, triggering a kernel crash during serial device interaction. The vulnerability affects Linux kernel versions from the initial commit up to the patched releases in kernel 6.12.58, 6.17.8, and 6.18. It was published on December 16, 2025, with patches available for the affected stable branches. The CVSS category is estimated as Medium (Red Hat CVE, Red Hat Bugzilla).

The root cause is a null/missing device pointer in the ip22zilog TTY serial driver's struct uart_port.dev field, classifiable as CWE-476 (NULL Pointer Dereference). Following the serial core refactor in commit 84a9582fd203, the serial subsystem began dereferencing uart_port.dev for runtime power management; since ip22zilog never populated this field, any interaction with the serial device triggers a kernel oops. The fix involves converting the ip22zilog driver to a platform driver model and properly initializing the serial device in the SGI IP22 platform code, ensuring uart_port.dev is set before the serial core accesses it (Red Hat Bugzilla, ENISA EUVD).

Exploitation of this vulnerability can cause kernel panics (oops) on Linux systems running SGI IP22 hardware with the ip22zilog serial driver loaded, resulting in system crashes and denial of service. The impact is limited to availability — confidentiality and integrity are not directly affected. Given the niche hardware platform (SGI IP22/MIPS-based systems), the scope of affected deployments is narrow, and there is no known potential for lateral movement or data exfiltration (Red Hat CVE, ENISA EUVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2025-68311. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is extremely low at approximately 0.017%, reflecting the minimal likelihood of exploitation given the highly specific hardware requirement (SGI IP22 platform) (Red Hat CVE, ENISA EUVD).

Patches are available in Linux kernel versions 6.12.58, 6.17.8, and 6.18, which convert the ip22zilog driver to a platform driver and properly initialize the serial device in SGI IP22 platform code. Administrators running affected kernel versions on SGI IP22 hardware should update to one of the patched releases. The upstream fix commits are available at the kernel stable tree (kernel stable, kernel stable, kernel stable). No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (Red Hat Bugzilla).