CVE-2025-68379: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68379 is a NULL pointer dereference vulnerability in the Linux kernel's RDMA RXE (Soft RoCE) subsystem, specifically within the rxe_srq_chk_attr() function. It was published on December 24, 2025, and affects Microsoft Azure Linux kernel versions 6.6.117.1-1 and 6.6.119.3-3, as well as broader Linux kernel distributions subsequently patched by Ubuntu and SUSE. The vulnerability carries a CVSS v3.1 base score of 4.4 (Medium), requiring high privileges and local access to exploit (Feedly, Microsoft MSRC).

The root cause is a NULL pointer dereference (CWE-476) in the RDMA RXE subsystem's shared receive queue (SRQ) handling. When ibv_modify_srq() is called twice in succession under certain error conditions, the first call may fail inside rxe_queue_resize(), causing rxe_srq_from_attr() to set srq->rq.queue = NULL. The second call then attempts to dereference srq->rq.queue->buf->index_mask in rxe_srq_chk_attr(), triggering a kernel panic. Exploitation requires a local attacker with high privileges (e.g., access to the ib_uverbs interface) and the ability to deliberately trigger the error path in rxe_queue_resize() before issuing a second ibv_modify_srq() call (Feedly).

Successful exploitation results in a kernel panic (system crash), causing a complete denial of service on the affected host. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Systems running RDMA workloads (e.g., high-performance computing or cloud infrastructure nodes using Soft RoCE) are at risk of unplanned downtime (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term. Exploitation requires high-privilege local access, significantly limiting the attacker population (Feedly).

Apply the available kernel patches released by the respective vendors. Microsoft has released fixes for Azure Linux kernel versions 6.6.119.3-3 and 6.6.117.1-1. Ubuntu has issued multiple security notices addressing this CVE (USN-8179-1, USN-8179-2, USN-8179-3, USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), and SUSE has also released a patch. As a workaround, restrict access to RDMA operations and the ib_uverbs interface to trusted, privileged users only to reduce exposure (Feedly, Microsoft MSRC, Ubuntu USN-8179-1).