CVE-2025-68228

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-16

Last updated on: 2025-12-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/plane: Fix create_in_format_blob() return value create_in_format_blob() is either supposed to return a valid pointer or an error, but never NULL. The caller will dereference the blob when it is not an error, and thus will oops if NULL returned. Return proper error values in the failure cases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-16

Last Modified

2025-12-18

Generated

2026-07-06

AI Q&A

2025-12-16

EPSS Evaluated

2026-07-04

NVD

CVE-2025-68228

EUVD

EUVD-2025-203668

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's drm/plane component, specifically in the create_in_format_blob() function. The function is supposed to return either a valid pointer or an error, but never NULL. However, it could return NULL, which causes the caller to dereference a NULL pointer, leading to a kernel oops (crash). The fix ensures that proper error values are returned instead of NULL in failure cases.

Impact Analysis

If exploited, this vulnerability can cause the Linux kernel to crash (kernel oops) due to dereferencing a NULL pointer. This can lead to system instability or denial of service.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for the drm/plane create_in_format_blob() function to ensure it returns proper error values instead of NULL, preventing kernel oops. Until the patch is applied, avoid using vulnerable kernel versions.

Hi! I’m here to help you understand CVE-2025-68228. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70