CVE-2025-68345: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68345 is a NULL pointer dereference vulnerability in the Linux kernel's ALSA (Advanced Linux Sound Architecture) HDA driver, specifically within the cs35l41_hda_read_acpi() function of the cs35l41 audio codec driver. The flaw was discovered by the Linux Verification Center (linuxtesting.org) using the SVACE static analysis tool and published on December 24, 2025. It affects Linux kernel versions from 5.17 up to the fixes introduced in stable releases 6.17.13, 6.18.2, and 6.19-rc1, as well as Microsoft Azure Linux 3 kernel packages azl3_kernel_6.6.117.1-1 and azl3_kernel_6.6.119.3-3. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC).

The root cause is a missing NULL pointer check (CWE-476) in cs35l41_hda_read_acpi(). The function acpi_get_first_physical_node() can legitimately return NULL when no physical ACPI node is found; the subsequent call to get_device() on that NULL value also returns NULL, but the code proceeds to dereference this NULL pointer without validation, triggering a kernel panic. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it straightforward for any local user on an affected system to trigger the crash by interacting with the vulnerable ACPI/audio driver code path. The fix adds an explicit NULL check before the dereference (Microsoft MSRC).

Successful exploitation causes a kernel crash (denial of service), impacting system availability with no confidentiality or integrity impact. A local attacker with low privileges can crash the affected system, potentially disrupting all services running on it. The scope is limited to the affected host; there is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.017% (0.000170), reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Microsoft MSRC).

Apply the available kernel patches immediately. Upstream Linux kernel fixes are available in versions 6.17.13, 6.18.2, and 6.19-rc1. For Microsoft Azure Linux 3, update to the patched kernel packages (beyond azl3_kernel_6.6.117.1-1 and azl3_kernel_6.6.119.3-3). Debian users should apply the fixes referenced in the Debian LTS announcement (linux 6.12.69-1 or later). Ubuntu users should apply the patches addressed in security notices USN-8179-1 through USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, and USN-8265-1. As a general workaround, restricting local user access on systems with the cs35l41 HDA audio driver loaded can reduce the attack surface (Microsoft MSRC).