CVE-2025-68330: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68330 is a NULL pointer dereference vulnerability in the Linux kernel's IIO (Industrial I/O) accelerometer driver for BMC150 devices (iio: accel: bmc150). The flaw arises from an unconditional call to bmc150_accel_set_interrupt() within the iio_buffer_setup_ops, including on the runtime PM resume path, which triggers a kernel panic when the device has no interrupts configured. It affects the Linux kernel across multiple stable branches and was disclosed on December 22, 2025. The CVSS v3.1 base score is 5.5 (Medium), reflecting a local attack vector with high availability impact and no confidentiality or integrity impact (Feedly, Microsoft MSRC).

The root cause is a missing IRQ availability check in bmc150-accel-core.c — the driver unconditionally invokes bmc150_accel_set_interrupt() during buffer setup operations without first verifying whether the device has an interrupt line configured (CWE classification not formally assigned by NVD). When a BMC150 accelerometer device lacks interrupt support and the IIO buffer is enabled (e.g., via a write to the enable sysfs attribute), the runtime PM resume path triggers bmc150_accel_buffer_postenable(), which calls the interrupt-setting function and dereferences a NULL pointer at virtual address 0x00000001, causing a kernel splat. The fix stores the IRQ number in the driver's state struct and gates all interrupt-related operations on its presence, a pattern common in other IIO drivers (Feedly, kernel.org patches).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash, leading to a complete denial of service for the affected host. The impact is limited to availability — there is no confidentiality or integrity compromise. Systems running Linux kernels with BMC150 accelerometer hardware (common in embedded and mobile platforms) and without interrupt lines configured are at risk of unexpected reboots or unresponsiveness when IIO buffer operations are performed (Feedly).

Patches have been applied to multiple Linux stable kernel branches: 5.15.197, 6.1.159, 6.6.119, 6.12.61, 6.17.11, and 6.18. Users should update to these or later versions. Ubuntu has issued security notices USN-8094-1 through USN-8094-5 addressing this vulnerability (Ubuntu USN-8094-1, Ubuntu USN-8094-2). Microsoft has also released a patch for Azure Linux 3 (kernel 6.6.117.1-1 and later) (Microsoft MSRC). As a temporary workaround, administrators can avoid enabling IIO buffers on systems with BMC150 accelerometers that lack interrupt lines, or disable runtime power management for the affected device.