Skip to main content

Linux Kernel CVE-2025-68167

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
1.9 LOW

Local root-only debugfs access (PR:H, AV:L) plus dependence on a non-controllable allocation failure (AC:H) yield only a kernel-crash availability impact (A:L), no confidentiality or integrity loss.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.7 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:31 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: fix invalid pointer access in debugfs

If the memory allocation in gpiolib_seq_start() fails, the s->private field remains uninitialized and is later dereferenced without checking in gpiolib_seq_stop(). Initialize s->private to NULL before calling kzalloc() and check it before dereferencing it.

AnalysisAI

Denial-of-service via invalid pointer access exists in the Linux kernel gpiolib debugfs interface, where a failed memory allocation in gpiolib_seq_start() leaves s->private uninitialized and later dereferenced in gpiolib_seq_stop(), crashing the kernel. The flaw affects systems exposing the GPIO debugfs seq_file (/sys/kernel/debug/gpio) and is triggerable only under memory-allocation failure. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not on CISA KEV.

Technical ContextAI

The bug lives in gpiolib (drivers/gpio/gpiolib.c), the kernel's core GPIO subsystem, specifically its debugfs seq_file iterator. seq_file's start/stop callbacks share state through s->private; gpiolib_seq_start() allocates that state with kzalloc() but, on allocation failure, returns without initializing s->private, which gpiolib_seq_stop() then dereferences unconditionally. The root-cause class is access of an uninitialized/NULL pointer (CWE-824/CWE-457, though NVD lists CWE as N/A). The fix initializes s->private to NULL before kzalloc() and null-checks it before use. Although the source tags this 'Information Disclosure,' the described code path is a use-of-uninitialized-pointer leading to a kernel oops rather than an actual data leak.

Affected ProductsAI

The Linux kernel gpiolib GPIO subsystem is affected in versions preceding the stable fixes. Exact affected version ranges are not enumerated in the provided data (no CPE strings supplied); the fix is distributed across three stable-tree commits: https://git.kernel.org/stable/c/2f6115ad8864cf3f48598f26c74c7c8e5c391919, https://git.kernel.org/stable/c/3c91c8f424d3e44c8645ab765a38773e58afb07d, and https://git.kernel.org/stable/c/70180a6031056096c93ed2f47c41803268bdd91c, indicating backports across multiple stable series. Systems most relevant are those built with CONFIG_DEBUG_FS and with the GPIO debugfs interface mounted.

RemediationAI

Upstream fix available (stable commits/backports); a released patched version is not independently confirmed from the provided data - apply the kernel update from your distribution that incorporates stable commits 2f6115ad8864, 3c91c8f424d3, and 70180a603105 (git.kernel.org/stable). As a compensating control until patched, restrict or avoid mounting debugfs (do not mount /sys/kernel/debug on hardened/production systems, or keep its default root-only 0700 permissions), since the vulnerable path is only reachable through the GPIO debugfs seq_file; the trade-off is loss of GPIO and other debugfs diagnostics. Because the trigger depends on an allocation failure rather than attacker input, no reliable runtime workaround exists beyond removing access to the interface.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed

Share

CVE-2025-68167 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy