CVE-2025-68812: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68812 is a rejected/withdrawn CVE originally assigned to a Linux kernel vulnerability in the iris media driver (media: iris). The original description described a use-after-free crash condition in iris_vb2_stop_streaming when called after iris_kill_session had already freed inst_hfi_gen2->packet. The CVE was initially published on January 13, 2026, and subsequently rejected by its CVE Numbering Authority (kernel.org) on April 3, 2026. No CVSS score has been assigned by NVD due to the rejection (NVD, CVE.org).

The original issue described a missing state check in the Linux kernel's iris_vb2_stop_streaming function. Specifically, if inst->state was already set to IRIS_INST_ERROR (e.g., after iris_kill_session executed session_close and freed inst_hfi_gen2->packet), a subsequent call to stop_streaming would attempt to send packets to firmware using the freed memory, causing a kernel crash (use-after-free / NULL dereference). The fix added a sanity check to skip the stream-off operation when the instance is already in an error state. Because the CVE was rejected, no CWE classification was formally assigned (NVD).

As this CVE has been officially rejected and withdrawn by kernel.org, there is no formally recognized security impact. The underlying code issue, if it existed, would have been a local kernel crash (denial of service) affecting systems using Qualcomm's Iris video codec driver on Linux. No confidentiality or integrity impact was described in the original report (NVD).

CVE-2025-68812 has been rejected and carries no known exploit code, PoC, or in-the-wild exploitation. Its EPSS score is extremely low at 0.000180 (approximately 0.018%), and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The Nessus plugin 283639 was associated with this CVE, but the rejection renders it moot (Feedly, Tenable).

Because CVE-2025-68812 has been officially rejected by kernel.org, no patches or workarounds are required specifically for this CVE identifier. The underlying code change (adding a state check in iris_vb2_stop_streaming) was referenced in kernel commits ad699fa78b59241c9d71a8cafb51525f3dab04d4 and f8b136296722e258ec43237a35f72c92a6d4501a, and is included in Linux 6.18.3 and 6.19-rc1, but these are not formally tied to this CVE (NVD).

The CVE received minimal industry attention given its short lifespan before rejection. It was briefly indexed by VulDB, Tenable (Nessus plugin 283639), and Red Hat's CVE tracker, but no significant researcher commentary or media coverage was generated. The kernel.org CVE announcement list published a rejection notice on April 3, 2026 (kernel.org lore).