What is the CVSS score of CVE-2025-68303?

CVE-2025-68303 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2025-68303?

The Intel P-Unit IPC kernel driver (intel_punit_ipc) on Linux x86 platforms contains a memory corruption vulnerability (CVE-2025-68303, CVSS 7.8) with no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2025-68303?

Within 24 hours, identify which systems in your environment run the intel_punit_ipc driver-primarily Intel SoC platforms in embedded, IoT, or edge deployments-and assess their criticality to operations. Over the next 7 days, monitor affected systems for unexplained crashes or kernel errors, document current driver versions, and establish communication with your infrastructure team to prepare for remediation. Within 30 days, evaluate interim mitigations: restrict local access to the driver via SELinux/AppArmor policies if not essential, consider disabling the driver if functionality permits, and subscribe to vendor advisories for patch availability.

Linux Kernel CVE-2025-68303

HIGH

2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Buffer Overflow Linux Red Hat Intel Suse

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Local driver-specific path raises AC:H and needs PR:L; the write target is a fixed miscalculation not attacker-controlled, so impact is availability-dominated (A:H) with limited integrity (I:L) and no confidentiality loss.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 07:12 vuln.today

CVE Published

Dec 16, 2025 - 16:16 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: intel: punit_ipc: fix memory corruption

This passes the address of the pointer "&punit_ipcdev" when the intent was to pass the pointer itself "punit_ipcdev" (without the ampersand). This means that the:

complete(&ipcdev->cmd_complete);

in intel_punit_ioc() will write to a wrong memory address corrupting it.

AnalysisAI

Kernel memory corruption in the Linux platform/x86 Intel P-Unit IPC driver (intel_punit_ipc) arises from an interrupt handler dereferencing the address of a global pointer variable (&punit_ipcdev) instead of the pointer itself, so the completion call complete(&ipcdev->cmd_complete) in intel_punit_ioc() writes to an incorrect memory location. Affected systems are those running the punit_ipc driver on specific Intel SoC platforms; a local low-privileged actor able to drive the IPC command path can corrupt kernel memory, most plausibly causing instability or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the issue is not in CISA KEV.

Technical ContextAI

The affected component is the Intel P-Unit (Power Management Unit) IPC mailbox driver in the Linux kernel's platform/x86 subsystem, which mediates command/response communication between the OS and Intel SoC power-control firmware (historically present on Broxton/Apollo Lake-class Atom platforms). The driver uses a completion object (cmd_complete) signaled from the IOC (I/O completion) interrupt handler. The defect is a pointer-handling error: code passed &punit_ipcdev (the address of the static driver pointer) where it should have passed punit_ipcdev (the pointer value). Because ipcdev is then computed from the wrong base, complete(&ipcdev->cmd_complete) writes the completion state to an out-of-bounds/incorrect kernel address. CWE is listed as N/A by the source, but this maps to the out-of-bounds/invalid write class (CWE-787-style memory corruption); the input tags it as 'Buffer Overflow.'

Affected ProductsAI

The affected product is the Linux kernel's Intel P-Unit IPC driver (drivers under platform/x86, intel_punit_ipc), loaded on Intel SoC platforms that expose the P-Unit IPC mailbox. No exact vulnerable/fixed kernel version numbers were provided in the input; the fix is distributed across six stable-tree commits (git.kernel.org/stable/c/15d560cd..., 3e7442c5..., 46e9d6f5..., 9b9c0adb..., a21615a4..., c2ee6d38...), which indicates backporting into multiple maintained stable branches. Users should map their running kernel and distro backports against these commit hashes to determine exposure; no dedicated vendor advisory URL beyond the kernel.org commit references was supplied.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the stable-tree kernel updates corresponding to the six git.kernel.org commits (15d560cd, 3e7442c5, 46e9d6f5, 9b9c0adb, a21615a4, c2ee6d38), or install your distribution's patched kernel package that incorporates them, then reboot. Because these are stable backports, most distributions will ship the fix in a routine kernel update; prioritize normally given the low real-world risk. As a targeted compensating control on systems that do not use Intel P-Unit IPC functionality, prevent the module from loading (e.g., blacklist/disable the intel_punit_ipc driver via modprobe configuration), which removes the vulnerable code path entirely at the cost of losing P-Unit IPC power-management telemetry/control on affected Intel SoCs; this is only viable where that platform feature is unused.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31