CVE-2025-68777: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68777 is an off-by-one error in the Linux kernel's ti_am335x_tsc (AM335x touchscreen controller) driver that allows a local attacker with low privileges to trigger an out-of-bounds array access, resulting in a denial of service. The flaw was published on January 13, 2026, and affects Linux kernel versions from 3.11 up to (but not including) the patched releases: 6.1.160, 6.6.120, 6.12.64, 6.18.3, and 6.19-rc2. Microsoft's Azure Linux 3 kernel package azl3_kernel version 6.6.119.3-3 and earlier is also confirmed affected. The CVSS v3.1 base score is 5.5 (Medium) (Feedly, Microsoft Advisory).

The root cause is an off-by-one validation error (CWE-193) in the ti_am335x_tsc input driver's wire_order configuration parsing. The faulty check wire_order[i] > ARRAY_SIZE(config_pins) permits wire_order[i] to equal ARRAY_SIZE(config_pins) (i.e., 4), which is one beyond the valid index range of 0–3 for the 4-element config_pins array. When this boundary value is subsequently used as an array index in config_pins[wire_order[i]], it results in an out-of-bounds memory read. The fix changes the comparison operator from > to >= to correctly reject the boundary value. Exploitation requires local access and low privileges, as an attacker must be able to supply crafted wire_order configuration values to the driver (Feedly, kernel.org patches).

Successful exploitation causes an out-of-bounds memory access in the kernel, leading to a kernel panic or system crash and a complete denial of service for the affected host. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems running affected kernel versions on hardware using the TI AM335x touchscreen controller (common in embedded Linux platforms) are at risk, and exploitation could disrupt any services running on the affected system (Feedly).

Apply the patched Linux kernel versions that correct the off-by-one error: 6.1.160, 6.6.120, 6.12.64, 6.18.3, or 6.19-rc2 and later. For Microsoft Azure Linux 3, update to a kernel version beyond azl3_kernel 6.6.119.3-3. Debian, Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), SUSE, and Red Hat have all issued advisories and updated packages. As a short-term workaround, restrict local system access to trusted users to reduce exposure, since exploitation requires local access with low privileges (Feedly, Microsoft Advisory, Debian LTS).

Red Hat, Debian, Ubuntu, SUSE, and Microsoft have all issued advisories or updated packages addressing this vulnerability, indicating broad vendor acknowledgment. No notable independent researcher commentary or significant social media discussion has been identified for this medium-severity kernel driver flaw (Feedly, Debian LTS).