CVE-2025-68808: media: vidtv: initialize local pointers upon transfer of memory ownership
In the Linux kernel, the following vulnerability has been resolved:
media: vidtv: initialize local pointers upon transfer of memory ownership
vidtvchannelsiinit() creates a temporary list (program, service, event) and ownership of the memory itself is transferred to the PAT/SDT/EIT tables through vidtvpsipatprogramassign(), vidtvpsisdtserviceassign(), vidtvpsieiteventassign().
The problem here is that the local pointer where the memory ownership transfer was completed is not initialized to NULL. This causes the vidtvpsipmtcreatesecforeachpatentry() function to fail, and in the flow that jumps to freeeit, the memory that was freed by vidtvpsitabledestroy() can be accessed again by vidtvpsieventdestroy() due to the uninitialized local pointer, so it is freed once again.
Therefore, to prevent use-after-free and double-free vulnerability, local pointers must be initialized to NULL when transferring memory ownership.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68808?
CVE-2025-68808 is classified as a medium-severity vulnerability in the Linux kernel.
How do I fix CVE-2025-68808?
To fix CVE-2025-68808, you should update the Linux kernel to the latest version where the vulnerability is patched.
What are the risks associated with CVE-2025-68808?
The risks associated with CVE-2025-68808 include potential memory corruption and instability in applications that rely on the affected kernel component.
Which versions of the Linux kernel are affected by CVE-2025-68808?
CVE-2025-68808 affects various versions of the Linux kernel prior to the implementation of the fix.
What components of the Linux kernel does CVE-2025-68808 impact?
CVE-2025-68808 specifically impacts the media subsystem, particularly the vidtv component of the Linux kernel.