CVE-2025-68739: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68739 is a Use-After-Free (UAF) vulnerability in the Linux kernel's PM/devfreq HiSi (HiSilicon) driver related to improper OPP (Operating Performance Point) resource handling. The flaw arises when dev_pm_opp_put(opp) is called before all required data has been acquired from the OPP object, violating the correct resource acquisition and release order. It was published on December 24, 2025, and affects Linux kernel versions up to the fix commits introduced in 6.17.13, 6.18.2, and 6.19-rc1. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.017% (Feedly, EUVD).

The vulnerability is classified as CWE-416 (Use-After-Free). In the HiSilicon devfreq driver (PM / devfreq: hisi), the code calls dev_pm_opp_put(opp) to release an OPP reference before all necessary data has been read from the OPP object. This incorrect ordering means the OPP memory may be freed while subsequent code still attempts to access it, resulting in a UAF condition. The fix ensures all required data is extracted from the OPP object prior to releasing it via dev_pm_opp_put(), restoring the correct acquire-then-release sequence (Feedly, Kernel Git).

A UAF in a kernel driver can lead to memory corruption, system crashes (denial of service), or potentially privilege escalation if an attacker can control the freed memory region before it is accessed again. The affected component is the HiSilicon-specific devfreq power management driver, limiting the scope primarily to systems running HiSilicon SoCs (e.g., certain ARM-based servers and embedded devices). In practice, exploitation is constrained by the need for local access and specific hardware, reducing the likelihood of widespread impact (Feedly, EUVD).

There is no public evidence of active in-the-wild exploitation of CVE-2025-68739, and no known proof-of-concept exploit code has been published. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system running a vulnerable Linux kernel on HiSilicon hardware (Feedly).

The Linux kernel project has released patches addressing this vulnerability in versions 6.17.13, 6.18.2, and 6.19-rc1. Administrators should update to a patched kernel version as soon as possible. The relevant fix commits are available at the kernel stable tree (Kernel Git 6.17, Kernel Git 6.18, Kernel Git rc1). No configuration-based workaround is known; upgrading the kernel is the recommended remediation.