CVE-2025-68804: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68804 is a Use-After-Free (UAF) vulnerability in the Linux kernel's platform/chrome: cros_ec_ishtp driver. After the driver is unbound, the kernel thread cros_ec_console_log_work continues to access the already-freed device structure, resulting in a UAF condition and system crash. The vulnerability affects Linux kernel versions starting from commit 26a14267aff218c60b89007fdb44ca392ba6122c across multiple stable branches. It was published on January 13, 2026, and NVD has not yet assigned a CVSS score; Feedly estimates the severity as Medium with an EPSS score of 0.000180 (Feedly, kernel.org).

The root cause is a missing call to unregister the Embedded Controller (EC) device in the driver's .remove() callback within the cros_ec_ishtp Chrome platform driver (CWE-416: Use After Free). When the driver is unbound, sub-devices are not shut down synchronously, leaving the cros_ec_console_log_work kthread running and accessing memory that has already been freed. The fix involves properly unregistering the EC device in .remove() to ensure all sub-devices are torn down before the driver releases its resources. Patches have been applied across multiple stable kernel branches (kernel.org patches).

Successful triggering of this vulnerability results in a kernel crash (system unavailability) due to the UAF condition when the cros_ec_console_log_work thread accesses freed memory after driver unbinding. The primary impact is a denial of service (system crash/panic) on affected Linux systems using the cros_ec_ishtp driver, which is specific to Chrome OS or Chromebook-style hardware with an Intel ISH (Integrated Sensor Hub) Embedded Controller. There is no evidence of confidentiality or integrity impact beyond the crash itself, and lateral movement potential is limited given the local, hardware-specific nature of the flaw (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches: 6.1.160, 6.6.120, 6.12.64, 6.18.3, and 6.19-rc1. Users should update to a patched kernel version. Downstream distributions including Debian (linux 6.1.162-1, linux 5.10.249-1), Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), SUSE, and others have issued updated packages. As a temporary workaround, avoiding manual unbinding of the cros_ec_ishtp driver on affected hardware can reduce exposure (Debian Tracker, Ubuntu USN-8177-1, kernel.org patches).