CVE-2025-68760: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68760 is a potential out-of-bounds read vulnerability in the Linux kernel's AMD IOMMU subsystem, specifically in the iommu_mmio_show() function. The flaw arises from a mismatch between the boundary check in iommu_mmio_write() (which validates for a 4-byte access) and the actual 8-byte readq() operation performed in iommu_mmio_show(). If a user supplies an offset equal to mmio_phys_end - 4, the write-side check passes but the show handler reads 4 bytes beyond the valid MMIO region. The vulnerability was published on January 5, 2026, and affects the Linux kernel; NVD has not yet assigned a CVSS score, though Feedly estimates it as Medium severity with an EPSS score of 0.000170 (Red Hat CVE, NVD).

The root cause is an off-by-one boundary validation error (CWE-125: Out-of-bounds Read) in the AMD IOMMU debug interface exposed via debugfs. In iommu_mmio_write(), the offset validation uses the expression iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4, which only guards against 4-byte overruns. However, iommu_mmio_show() calls readq(), a 64-bit (8-byte) read operation, meaning an offset of mmio_phys_end - 4 passes validation but causes a 4-byte out-of-bounds read beyond the mapped MMIO region. The fix adjusts the boundary check to use sizeof(u64) (i.e., 8 bytes) to match the actual read size. Three upstream kernel patches address this issue (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3).

Successful exploitation of this vulnerability could allow a local user with access to the AMD IOMMU debugfs interface to read 4 bytes of kernel memory beyond the intended MMIO boundary, potentially exposing sensitive kernel data. The impact is primarily a confidentiality concern — an attacker could leak kernel memory contents that might aid in further exploitation (e.g., defeating KASLR). Integrity and availability are not directly affected by this read-only out-of-bounds access (Red Hat CVE, NVD).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-68760. The EPSS score is very low at 0.000170, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system with an AMD IOMMU and access to the relevant debugfs interface, significantly limiting the attack surface (Red Hat CVE).

The fix has been committed to the Linux kernel stable tree via three patches that correct the boundary check in iommu_mmio_write() to use sizeof(u64) instead of the hardcoded value of 4. System administrators should apply the relevant kernel updates from their Linux distribution vendor (e.g., Red Hat) once patches are released for their specific kernel version. As a workaround, restricting access to the debugfs filesystem (e.g., mounting with debugfs access controls or disabling it entirely) can mitigate exposure (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3, Red Hat CVE).