CVE-2025-68789: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68789 is a rejected/withdrawn CVE that was originally assigned to a use-after-free vulnerability in the Linux kernel's hwmon ibmpex driver. The CVE was initially published on January 13, 2026, and subsequently rejected by its CVE Numbering Authority (kernel.org) on February 10, 2026 (NVD). Prior to rejection, it was described as affecting Linux kernel versions from 2.6.24 onward, with Microsoft's Azure Linux kernel 6.6.119.3-3 specifically identified as a vulnerable product (Feedly). A CVSS v3.1 score of 9.8 (Critical) was assigned by Microsoft's MSRC, though this score is not endorsed by NVD given the CVE's rejected status (Feedly).

The original vulnerability description identified a use-after-free (CWE-416) condition in the ibmpex_high_low_store() function of the Linux kernel's hwmon ibmpex driver. The function retrieved driver data via dev_get_drvdata() without validating the returned pointer, creating a TOCTOU (time-of-check-time-of-use) race condition where a sysfs write callback could be invoked after the underlying data structure had already been freed during device removal (NVD, Feedly). The proposed fix involved adding a NULL check after dev_get_drvdata() and reordering operations in the deletion path to eliminate the race window. Because the CVE was subsequently rejected by kernel.org, the exact reason for withdrawal (e.g., duplicate, incorrect assignment, or non-issue determination) has not been publicly detailed.

As originally described, successful exploitation of this race condition could allow a local attacker with access to sysfs interfaces to trigger a use-after-free memory condition, potentially resulting in unauthorized disclosure of sensitive kernel memory, data manipulation, or a denial of service (system crash/kernel panic) (Feedly). The scope was limited to local access — no network-based exploitation path was identified. Given the CVE's rejected status, the actual security impact may be considered negligible or the issue may have been addressed under a different identifier.

Because CVE-2025-68789 has been rejected by its CVE Numbering Authority, no formal patch is required under this identifier (NVD). Prior to rejection, kernel commits were referenced for versions 6.1.160, 6.6.120, 6.12.64, 6.18.3, and 6.19-rc2 as containing the fix (Feedly). Organizations should keep Linux kernels updated to current stable releases as a general best practice, and restrict local access to sysfs interfaces where feasible. Vulnerability scanners (Nessus plugin IDs 298403, 298404, 299777; Qualys ID 916950) may still flag this CVE — teams should note its rejected status when triaging findings.

Red Hat published a security advisory page for CVE-2025-68789, and Microsoft's MSRC assigned a CVSS score prior to the CVE's rejection (Feedly). No significant researcher commentary, social media discussion, or media coverage has been identified for this CVE, consistent with its low EPSS score and subsequent rejection.