CVE-2025-68167: gpiolib: fix invalid pointer access in debugfs
In the Linux kernel, the following vulnerability has been resolved:
gpiolib: fix invalid pointer access in debugfs
If the memory allocation in gpiolibseqstart() fails, the s->private field remains uninitialized and is later dereferenced without checking in gpiolibseqstop(). Initialize s->private to NULL before calling kzalloc() and check it before dereferencing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the gpiolib code path so that s->private is initialized to NULL before any allocation/call in gpiolib_seq_start(), and in gpiolib_seq_stop() dereference only after verifying kzalloc() succeeded (i.e., s->private is non-NULL).
Linux kernel gpiolib gpiolib_seq_start() / gpiolib_seq_stop() s->private initialization and null-check = Initialize s->private to NULL before calling kzalloc() and check s->private after kzalloc() before dereferencing it in gpiolib_seq_stop()
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68167?
CVE-2025-68167 has a severity rating of 7.8, indicating a high risk.
What components are affected by CVE-2025-68167?
CVE-2025-68167 affects the gpiolib component of the Linux kernel.
How do I fix CVE-2025-68167?
To fix CVE-2025-68167, update to the latest version of the Linux kernel that addresses this vulnerability.
What type of vulnerability is CVE-2025-68167?
CVE-2025-68167 is an invalid pointer dereference vulnerability due to uninitialized memory.
What could happen if CVE-2025-68167 is exploited?
Exploitation of CVE-2025-68167 could lead to memory corruption, system crashes, or unauthorized access.