CVE-2025-68375: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68375 is a NULL pointer dereference vulnerability in the Linux kernel's perf/x86 subsystem, specifically in the Intel PEBS (Precise Event-Based Sampling) record draining logic. The flaw was published on December 24, 2025, and affects Linux kernel versions introduced with commit 9734e25fbf5a, patched in stable releases 6.17.13, 6.18.2, and 6.19-rc1. The vulnerability is estimated as Medium severity by Feedly; no official CVSS score has been assigned at this time (Feedly, EUVD).

The root cause is a NULL pointer dereference (CWE-476) in intel_pmu_drain_pebs_icl(). When processing PEBS records, perf_event_overflow() can trigger interrupt throttling via the call chain perf_event_overflow() → __perf_event_overflow() → __perf_event_account_interrupt() → perf_event_throttle_group() → perf_event_throttle() → event->pmu->stop() → x86_pmu_stop(). The side effect of x86_pmu_stop() is that all event pointers in the cpuc->events[] array are cleared to NULL. If two PEBS events (e.g., event a and event b) are in the same group, processing event a's last PEBS record can trigger throttling that NULLs both pointers; when the code subsequently attempts to process event b's record, it dereferences a NULL pointer. The fix moves cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del(), which is safe because cpuc->active_mask and cpuc->pebs_enabled are always checked before accessing event pointers (Feedly, Kernel Patch 1).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, which typically results in a kernel panic (system crash), leading to a denial of service on the affected host. The vulnerability is local in nature and requires the ability to configure and run perf events on an Intel x86 system. There is no evidence of confidentiality or integrity impact beyond system availability loss; lateral movement or data exfiltration are not associated with this vulnerability (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in stable versions 6.17.13, 6.18.2, and 6.19-rc1. The fix is implemented by moving cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del(). Users and administrators should update to a patched kernel version as soon as possible. The relevant upstream commits are available at the kernel stable repository (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).