CVE-2025-68766: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68766 is an out-of-bounds access vulnerability in the Linux kernel's irqchip/mchp-eic driver, specifically within the mchp_eic_domain_alloc() function. When irq_domain_translate_twocell() sets the hwirq value to a number greater than or equal to MCHP_EIC_NIRQ (2), the code performs an out-of-bounds memory access. Although the code checks for invalid values, it fails to set an appropriate error code and incorrectly returns success instead of -EINVAL. The vulnerability was published on January 5, 2026, and primarily affects Linux systems using Microchip EIC (External Interrupt Controller) hardware. No official CVSS score has been assigned by NVD; Feedly estimates the severity as Medium with an EPSS score of 0.000180 (Red Hat CVE, Feedly).

The root cause is improper error handling (related to CWE-703: Improper Check or Handling of Exceptional Conditions) in the mchp_eic_domain_alloc() function of the Linux kernel's irqchip/mchp-eic driver. When the IRQ domain translation function irq_domain_translate_twocell() produces a hardware IRQ number (hwirq) of 2 or greater — exceeding the valid range defined by MCHP_EIC_NIRQ — the function proceeds without returning an error, leading to an out-of-bounds memory access in kernel space. The fix, available in multiple stable kernel branches, corrects this by explicitly returning -EINVAL when an out-of-range hwirq value is detected (kernel.org patch, kernel.org patch). Exploitation requires local access to a system with Microchip EIC hardware and the ability to interact with the interrupt subsystem.

Successful exploitation of this vulnerability by a local attacker could result in kernel memory corruption due to the out-of-bounds access, potentially leading to denial of service (kernel panic/crash) or, in more severe scenarios, privilege escalation if the attacker can control or influence the data accessed or overwritten in kernel memory. The impact is most significant on systems that use Microchip EIC (External Interrupt Controller) hardware, limiting the affected population to embedded or specialized Linux deployments. There is no evidence of data exfiltration risk or lateral movement potential beyond the local system (Red Hat CVE, Feedly).

Patches have been applied to multiple Linux stable kernel branches, with fixes available at several kernel.org commits (e.g., 09efe7cfbf91, 3873afcb5761, 7dbc0d40d834, efd65e2e2fd9, 324c60a67c4b, c21c606ad398). Downstream distributions including Debian (linux 6.1.162-1), Ubuntu (USN-8179-1/2/3/4, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), and Red Hat have released updated kernel packages. Administrators should apply the latest kernel security updates for their distribution promptly, and restrict local user access on systems utilizing Microchip EIC hardware as an interim measure (Red Hat CVE, Debian LTS, Ubuntu USN-8179-1).