CVE-2025-68808: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68808 is a use-after-free and double-free vulnerability in the Linux kernel's vidtv (virtual digital TV) media driver module. It was published on January 13, 2026, and affects Linux kernel versions including the 5.10, 6.1, 6.6, and 6.12 stable branches, introduced at commit 3be8037960bccd13052cfdeba8805ad785041d70. The flaw arises in vidtv_channel_si_init() when local pointers are not set to NULL after memory ownership is transferred to PAT/SDT/EIT tables, enabling double-free conditions during error handling. No official CVSS score has been assigned by NVD; Feedly estimates the severity as Medium with an EPSS score of 0.000180 (Feedly, kernel.org).

The root cause is improper memory management (CWE category: use-after-free / double-free) in the vidtv_channel_si_init() function within the Linux kernel's drivers/media/test-drivers/vidtv/ subsystem. When temporary data structures (program, service, event lists) are assigned to PAT/SDT/EIT tables via vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign(), and vidtv_psi_eit_event_assign(), the local pointers holding those structures are not subsequently set to NULL. If vidtv_psi_pmt_create_sec_for_each_pat_entry() then fails and execution jumps to the free_eit cleanup label, vidtv_psi_*_table_destroy() frees the memory, but the stale local pointers cause vidtv_psi_*_event_destroy() to attempt freeing the same memory again. Exploitation requires local access and the vidtv module to be loaded (Feedly, kernel.org).

Successful exploitation can result in kernel memory corruption, denial of service (kernel crash or hang), or potentially arbitrary code execution with kernel privileges. The vulnerability is locally exploitable and limited to systems where the vidtv media driver module is loaded, which is typically only present in development or testing environments. Lateral movement potential is limited, but kernel-level code execution would grant an attacker full control over the affected system (Feedly).

Patches have been released across multiple Linux stable branches. Users should update to the following fixed versions: Linux 6.1.160 or later (commit 3caa18d35f1dabe85a3dd31bc387f391ac9f9b4e), Linux 6.6.120 or later (commit 30f4d4e5224a9e44e9ceb3956489462319d804ce), Linux 6.12.64 or later (commit 98aabfe2d79f74613abc2b0b1cef08f97eaf5322), Linux 5.10 branch (commit fb9bd6d8d314b748e946ed6555eb4a956ee8c4d8), and Linux 6.19-rc1 or later. Debian, Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, and subsequent updates), and SUSE have also issued advisories. As a workaround, if the vidtv module is not required, it can be disabled or blacklisted to eliminate the attack surface (Feedly, Ubuntu Advisory, Debian LTS).

The vulnerability has been addressed through standard Linux kernel stable branch processes, with Debian, Ubuntu, and SUSE all issuing security advisories. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability, consistent with its low EPSS score and limited exploitability (Ubuntu Advisory, Debian LTS).