CVE-2025-68335: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68335 is a null pointer dereference vulnerability in the Linux kernel's Comedi PCL818 driver, specifically within the pcl818_ai_cancel() function. The flaw occurs during early device detachment via pcl818_detach(), where the subdevice's read_subdev may not have initialized its pointer to struct comedi_async, causing a general protection fault and kernel crash when s->async->cmd is dereferenced. The vulnerability was discovered by Syzbot and disclosed on December 22, 2025. It affects multiple Linux kernel versions across distributions including Red Hat, Debian, and Ubuntu. The CVSS category is estimated as Medium (Red Hat CVE, Feedly).

The root cause is a null pointer dereference (CWE-476) in drivers/comedi/drivers/pcl818.c. When pcl818_detach() is called during early device detachment — before the subdevice has fully initialized its async command support — the s->async pointer remains uninitialized (NULL or non-canonical). The subsequent call to pcl818_ai_cancel() attempts to dereference s->async->cmd, triggering a KASAN-detected null-ptr-deref in the range [0x0000000000000028-0x000000000000002f] and a general protection fault. The fix removes the explicit call to pcl818_ai_cancel() from pcl818_detach(), relying instead on the subdevice's own ->cancel() function invoked by comedi_device_detach_locked() when async support is present (Red Hat CVE). Exploitation requires local access to a system with the PCL818 Comedi driver loaded and the ability to trigger device detachment.

Successful exploitation causes a kernel general protection fault, resulting in a system crash and denial of service. The vulnerability primarily affects availability; systems running the PCL818 Comedi driver in data acquisition or industrial control environments are at risk of unexpected reboots or kernel panics. In some scenarios, kernel memory corruption from the fault could theoretically be leveraged for privilege escalation, though no such exploitation has been demonstrated (Red Hat CVE, Feedly).

Apply the upstream Linux kernel patch that removes the pcl818_ai_cancel() call from pcl818_detach() (available in kernel.org stable trees via commits 5caa40e7c6a4, 88d99ca5adbd, 877adccfacb3, and 935ad4b3c325). Distribution-specific updates are available through Red Hat, Debian (linux 6.1.162-1, DLA-4476-1), and Ubuntu (USN-8094-1 through USN-8094-5, USN-8179-1 through USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1). As a workaround where patching is not immediately possible, unloading or blacklisting the pcl818 kernel module (modprobe -r pcl818 or adding blacklist pcl818 to /etc/modprobe.d/) will prevent the vulnerable code path from being reached (Red Hat CVE, Ubuntu USN-8094-1).