CVE-2025-68379: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68379 is a NULL pointer dereference vulnerability in the Linux kernel's RDMA RXE (Soft RoCE) subsystem, specifically within the rxe_srq_chk_attr() function. It was published on December 24, 2025, and affects Microsoft Azure Linux kernel versions 6.6.117.1-1 and 6.6.119.3-3, as well as broader Linux kernel distributions subsequently patched by Ubuntu and SUSE. The vulnerability carries a CVSS v3.1 base score of 4.4 (Medium), requiring high privileges and local access to exploit (Feedly, Microsoft MSRC).

The root cause is a NULL pointer dereference (CWE-476) in the RDMA RXE subsystem's shared receive queue (SRQ) handling. When ibv_modify_srq() is called twice in succession under certain error conditions, the first call may fail inside rxe_queue_resize(), causing rxe_srq_from_attr() to set srq->rq.queue = NULL. The second call then attempts to dereference srq->rq.queue->buf->index_mask in rxe_srq_chk_attr(), triggering a kernel panic. Exploitation requires a local attacker with high privileges (e.g., access to the ib_uverbs interface) and the ability to deliberately trigger the error path in rxe_queue_resize() before issuing a second ibv_modify_srq() call (Feedly).

Successful exploitation results in a kernel panic (system crash), causing a complete denial of service on the affected host. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Systems running RDMA workloads (e.g., high-performance computing or cloud infrastructure nodes using Soft RoCE) are at risk of unplanned downtime (Feedly, Microsoft MSRC).

Apply the available kernel patches released by the respective vendors. Microsoft has released fixes for Azure Linux kernel versions 6.6.119.3-3 and 6.6.117.1-1. Ubuntu has issued multiple security notices addressing this CVE (USN-8179-1, USN-8179-2, USN-8179-3, USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), and SUSE has also released a patch. As a workaround, restrict access to RDMA operations and the ib_uverbs interface to trusted, privileged users only to reduce exposure (Feedly, Microsoft MSRC, Ubuntu USN-8179-1).