Linux Kernel CVE-2025-68808

In the Linux kernel, the following vulnerability has been resolved:

media: vidtv: initialize local pointers upon transfer of memory ownership

vidtv_channel_si_init() creates a temporary list (program, service, event) and ownership of the memory itself is transferred to the PAT/SDT/EIT tables through vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign(), vidtv_psi_eit_event_assign().

The problem here is that the local pointer where the memory ownership transfer was completed is not initialized to NULL. This causes the vidtv_psi_pmt_create_sec_for_each_pat_entry() function to fail, and in the flow that jumps to free_eit, the memory that was freed by vidtv_psi_*_table_destroy() can be accessed again by vidtv_psi_*_event_destroy() due to the uninitialized local pointer, so it is freed once again.

Therefore, to prevent use-after-free and double-free vulnerability, local pointers must be initialized to NULL when transferring memory ownership.

The vulnerability affects the Linux kernel's vidtv virtual DVB test driver across multiple stable branches, as evidenced by seven separate stable-tree fix commits (git.kernel.org/stable/c/12ab6ebb..., 30f4d4e5..., 3caa18d3..., 98aabfe2..., a69c7fd6..., c342e294..., fb9bd6d8...), which indicates the fix was backported to several supported longterm/stable series. Exact affected version ranges are not enumerated in the provided NVD data (references carry no version metadata), so specific kernel version boundaries should be confirmed per distribution. Ubuntu explicitly tracks and fixes this in security notice USN-8096-1 (https://ubuntu.com/security/notices/USN-8096-1), and it is cataloged at VulDB (https://vuldb.com/?id.340705).