CVE-2025-68737: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68737 is a vulnerability in the Linux kernel's arm64 page attribute subsystem (arm64/pageattr) where the return value from __change_memory_common is not properly propagated to callers. This flaw means that when the rodata=on security measure is active and a vmalloc → set_memory_ro/set_memory_rox code path fails to protect the linear map alias, the error is silently suppressed rather than returned to the caller, potentially leaving memory protections in an inconsistent state. The issue was introduced following commit a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full") and affects Linux kernel versions from that commit up to (but not including) the patched commits. It was published on December 24, 2025, with a Feedly CVSS category estimate of Medium and an EPSS score of 0.00018 (Feedly, CVE.org).

The root cause is improper error handling (CWE-390: Detection of Error Condition Without Action) in the arm64 memory attribute change path. When __change_memory_common is called to enforce read-only or read-execute-only protections on vmalloc'd memory, any failure to also protect the linear map alias is silently ignored — the error code is not propagated back to set_memory_ro or set_memory_rox, so callers cannot detect or respond to the failure. This is particularly significant under the rodata=on kernel security configuration, where both the vmalloc mapping and its linear map alias must be protected; a partial failure leaves the linear map alias writable, undermining the intended memory protection. The fix involves propagating the return value from __change_memory_common through the call chain so callers can abort on failure (Feedly, Kernel Patch 1, Kernel Patch 2).

If exploitation conditions are met, the vulnerability can result in the linear map alias of vmalloc'd memory remaining writable when it should be read-only or read-execute-only, effectively bypassing the rodata=on kernel hardening measure. This could allow a local attacker or malicious kernel module to modify memory that is supposed to be immutable, potentially enabling privilege escalation or undermining kernel integrity protections. The impact is primarily on the integrity and availability of kernel memory protections on arm64 systems with rodata=on or rodata=full enabled (Feedly).

The fix has been applied in Linux kernel stable branches via commits 3e2fc1e57a5361633a4bf4222640c6bfe41ff8ea and e5efd56fa157d2e7d789949d1d64eccbac18a897, with patched versions including Linux 6.18.2 and 6.19-rc1. Users running affected arm64 systems should update to a patched kernel version. Oracle Linux 9 has also issued advisories (ELISA-2026-50160 and ELSA-2026-50232) incorporating this fix. As a temporary measure, disabling rodata=full (reverting to a configuration where large block mapping is not used) may reduce exposure, but upgrading to a patched kernel is the recommended remediation (Kernel Patch 1, Kernel Patch 2, Feedly).

Coverage of CVE-2025-68737 has been limited to automated vulnerability tracking platforms and scanner vendors (Tenable Nessus, Qualys), with no notable researcher commentary or significant media coverage identified. The vulnerability was noted on Bluesky via automated CVE feeds and indexed by several vulnerability aggregators shortly after publication (Feedly).