Linux Kernel CVE-2025-68334

CVSS vector data is absent, preventing standard CVSS-based severity calculation; however, EPSS score of 0.03% (8th percentile) indicates minimal statistical exploitation probability in the wild. No CISA KEV status is provided, suggesting no confirmed active exploitation outside controlled environments. The denial of service impact is restricted to local attack surface - only users with physical access or local system login can trigger suspend operations. The vulnerability does not enable privilege escalation, data exfiltration, or remote code execution. Real-world risk is low for servers and infrastructure but moderate for end-users of affected handheld devices who rely on suspend functionality for battery life. The technical impact is primarily availability (device becomes unresponsive until hard reset), not confidentiality or integrity. This represents a quality-of-life issue for a narrow hardware subset rather than a systemic security threat.

A user of an ASUS ROG Ally (non-X) handheld device closes the device lid or presses the power button expecting suspend, which is a common power-saving action. The kernel PMC driver, lacking Van Gogh SoC support, fails to properly transition the system to S0ix sleep state. The GPU driver detects the incomplete power state and attempts recovery, hitting a power hang. The device freezes unresponsively, and the user is forced to perform a hard power-cycle. While not exploitable remotely, this represents a practical denial of service to handheld device users who depend on suspend for portability. No public exploit code is needed; the condition is triggered by standard OS suspend mechanisms.