BaseFortify

Publication date: 2025-12-16

Last updated on: 2025-12-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cpufreq/longhaul: handle NULL policy in longhaul_exit longhaul_exit() was calling cpufreq_cpu_get(0) without checking for a NULL policy pointer. On some systems, this could lead to a NULL dereference and a kernel warning or panic. This patch adds a check using unlikely() and returns early if the policy is NULL. Bugzilla: #219962

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-16

Last Modified

2025-12-18

Generated

2026-07-06

AI Q&A

2025-12-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68177

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the Linux kernel's cpufreq/longhaul component where the function longhaul_exit() calls cpufreq_cpu_get(0) without checking if the policy pointer is NULL. On some systems, this can cause a NULL pointer dereference, leading to a kernel warning or panic. The issue is fixed by adding a check to return early if the policy is NULL.

Impact Analysis

If triggered, this vulnerability can cause a kernel warning or panic due to a NULL pointer dereference. This can lead to system instability or crashes, potentially causing downtime or loss of service.

Mitigation Strategies

Apply the patch that adds a NULL check in longhaul_exit() to prevent the NULL dereference. This involves updating the Linux kernel to the fixed version that includes this patch.

Hi! I’m here to help you understand CVE-2025-68177. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70