CVE-2025-68798: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68798 is a NULL pointer dereference vulnerability in the Linux kernel's AMD performance monitoring unit (PMU) subsystem, specifically in the amd_pmu_enable_all() function. It affects Linux kernel versions running on AMD hardware, including Microsoft Azure Linux kernel version azl3_kernel_6.6.119.3-3 and various upstream stable kernel branches. The vulnerability was published on January 13, 2026, with a patch noted by January 15, 2026. It carries a CVSS v3.1 base score of 5.8 (Medium) (Microsoft MSRC).

The root cause is a race condition (CWE-362) in the Linux kernel's AMD PMU implementation where cpuc->events[idx] can become NULL due to a subtle interaction between NMI handlers, throttling logic, and x86_pmu_stop(). When amd_pmu_enable_all() subsequently attempts to enable performance events without first checking for a NULL pointer, a General Protection Fault (GPF) occurs, manifesting as a KASAN null-pointer-dereference in the range [0x00000000000001a0-0x00000000000001a7]. The vulnerability was discovered via Syzkaller fuzzing and is specific to AMD hardware. The attack vector is local, requires low privileges, and has high complexity due to the timing-dependent nature of the race condition (Microsoft MSRC).

Successful exploitation causes a kernel General Protection Fault, resulting in a system crash and denial of service (high availability impact). Secondary impacts include low-severity confidentiality and integrity effects, potentially arising from memory state exposure during the fault condition. The vulnerability is limited in scope to the local system on AMD hardware and does not provide a direct path for remote code execution or lateral movement (Microsoft MSRC).

Apply available kernel security updates that include the NULL pointer check fix in amd_pmu_enable_all(). The patch has been applied to Microsoft Azure Linux kernel azl3_kernel_6.6.119.3-3, and fixes are available across multiple stable kernel branches (referenced via kernel.org commits). Downstream distributions including Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), Debian (linux 6.1.162-1), SUSE, and Oracle Linux 9 have also released patched packages. As a temporary workaround where patching is not immediately possible, consider disabling performance event monitoring if not operationally required, and restrict local user access to reduce the attack surface (Microsoft MSRC, Ubuntu USN-8177-1).