CVE-2025-68746: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68746 is a use-after-free vulnerability in the Linux kernel's Tegra210 QSPI (Quad SPI) driver (spi: tegra210-quad) caused by improper timeout handling. When the CPU running the QSPI interrupt handler becomes excessively busy, the IRQ thread may not execute before a transfer timeout occurs, leaving the curr_xfer field pointing to stale (freed) memory. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from 5.12 up to the patched releases, including Microsoft Azure Linux 3 kernel packages azl3_kernel_6.6.117.1-1 and azl3_kernel_6.6.119.3-3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is a use-after-free condition (CWE-416) in the spi-tegra210-quad kernel driver. During timeout handling, pending SPI transfers are cleaned up and the associated message is marked as failed, but the curr_xfer pointer is not cleared — leaving it referencing freed memory. When the IRQ thread eventually runs after the timeout, it may dereference this stale pointer, causing memory corruption. The fix clears curr_xfer to NULL upon timeout and adds a NULL check in the IRQ thread, while also ensuring interrupts are cleared on failure to allow subsequent interrupt processing (Feedly). The attack vector is local, requires low privileges, and has no user interaction requirement.

Successful exploitation can cause kernel panics, system hangs, or unpredictable kernel behavior, resulting in a denial of service (high availability impact). There is no confidentiality or integrity impact, as the vulnerability is limited to availability. Systems actively performing QSPI transfers on Tegra210-based hardware or affected Azure Linux 3 kernel builds are at risk of service disruption (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, limiting the practical attack surface primarily to multi-tenant or shared systems running affected Tegra210 or Azure Linux 3 kernel builds.

Update the Linux kernel to a patched version: 6.12.63, 6.17.13, 6.18.2, or 6.19-rc1 or later. Specific upstream fix commits are available for backporting: 551060efb156c50fe33799038ba8145418cfdeef, bb0c58be84f907285af45657c1d4847b960a12bf, 01bbf25c767219b14c3235bfa85906b8d2cb8fbc, and b4e002d8a7cee3b1d70efad0e222567f92a73000. Microsoft Azure Linux 3 users should update from the vulnerable azl3_kernel_6.6.117.1-1 and azl3_kernel_6.6.119.3-3 packages. As a temporary workaround, limit use of QSPI interfaces and consider pinning QSPI interrupt handling to dedicated, less-loaded CPU cores to reduce the likelihood of CPU saturation triggering the timeout condition (Feedly, Microsoft MSRC).