CVE-2025-68335
Null Pointer Dereference in Linux comedi pcl818 Driver Causes Kernel Crash
Publication date: 2025-12-22
Last updated on: 2025-12-22
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| comedi | pcl818 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a null pointer dereference in the Linux kernel's comedi pcl818 driver, specifically in the pcl818_ai_cancel() function. It occurs because when a device is detached early via pcl818_detach(), a pointer to a structure (comedi_async) may not be properly initialized. Dereferencing this uninitialized pointer leads to a general protection fault and causes the kernel to crash. The fix involves removing the call to pcl818_ai_cancel() from pcl818_detach() to avoid dereferencing the null pointer, relying instead on the subdevice's own cancel function to handle asynchronous command cancellation.
How can this vulnerability impact me? :
This vulnerability can cause a general protection fault leading to a kernel crash. This means that systems using the affected pcl818 driver in the Linux kernel could experience unexpected crashes or instability, potentially leading to downtime or loss of service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for general protection faults related to pcl818_ai_cancel(), such as null pointer dereferences causing kernel crashes. You can check the kernel log using commands like 'dmesg | grep pcl818_ai_cancel' or 'journalctl -k | grep pcl818_ai_cancel' to identify any crash reports or oops messages referencing pcl818_ai_cancel or pcl818_detach.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, remove the call to pcl818_ai_cancel() from pcl818_detach() in the Linux kernel source. This ensures that asynchronous command cancellation is handled properly via the subdevice's own cancel() function in comedi_device_detach_locked(), preventing null pointer dereferences and kernel crashes.