CVE-2025-68354: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68354 is a race condition vulnerability in the Linux kernel's regulator core subsystem, specifically affecting the regulator_supply_alias_list data structure. The flaw arises because regulator_supply_alias(), regulator_register_supply_alias(), and regulator_unregister_supply_alias() access this list without any mutex protection, enabling concurrent threads to race during registration, unregistration, and lookup operations. It was published on December 24, 2025, and affects Linux kernel versions from 3.13 up to the patched releases (6.12.63, 6.17.13, 6.18.2, and 6.19-rc1); Microsoft Azure Linux 3 packages azl3_kernel_6.6.117.1-1 and azl3_kernel_6.6.119.3-3 are also affected. The CVSS v3.1 base score is 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is a missing critical section (CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) around all operations on the regulator_supply_alias_list linked list in drivers/regulator/core.c. Without the regulator_list_mutex held during traversals, insertions, and deletions, three distinct race conditions can manifest: (1) a use-after-free if an alias entry is freed while another thread is reading it; (2) duplicate alias entries if two threads simultaneously register the same alias; and (3) inconsistent alias mappings visible to regulator consumers. The fix protects all three functions — regulator_supply_alias(), regulator_register_supply_alias(), and regulator_unregister_supply_alias() — with the existing regulator_list_mutex. Exploitation requires local access with low privileges and no user interaction (Feedly, Linux Kernel Patch).

The primary impact is a denial of service (kernel crash or system instability) resulting from use-after-free memory corruption in the regulator subsystem, reflected in the CVSS availability impact of High with no confidentiality or integrity impact. In more severe scenarios, the use-after-free condition could theoretically be leveraged for local privilege escalation or arbitrary kernel code execution, though no such exploitation has been demonstrated publicly. Systems relying on dynamic regulator supply alias management — common in embedded and SoC-based platforms — are most at risk of instability or incorrect power rail routing (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, limiting the attack surface primarily to multi-tenant or shared kernel environments (Feedly).

Update to a patched Linux kernel version: 6.12.63 or later (for the 6.12.x LTS series), 6.17.13 or later (6.17.x), 6.18.2 or later (6.18.x), or 6.19-rc1 or later. For Microsoft Azure Linux 3, update the azl3_kernel packages beyond the affected versions 6.6.117.1-1 and 6.6.119.3-3. Debian users should update to linux 6.1.162-1 (oldstable) or linux 5.10.249-1 (oldoldstable) as addressed in DSA-6127-1 and DLA-4475-1. Ubuntu users should apply the fixes provided in USN-8179-x, USN-8184-1, USN-8185-x, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1, and related notices. Amazon Linux 2 users should apply ALAS2KERNEL-5.10-2026-113. No configuration-based workaround is available; patching is the only remediation (Feedly, Microsoft MSRC).