CVE-2025-68309 - Vulnerability Details - OpenCVE

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI/AER: Fix NULL pointer access by aer_info

The kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info->xxx
will result in kernel panic. Fix it.

Published: 2025-12-16

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

Linux

unaffected

Version	Status	Constraints
`a57f2bfb4a5863f83087867c0e671f2418212d23`	affected	< 6618243bcc3f60825f761a41ed65fef9fe97eb25
`a57f2bfb4a5863f83087867c0e671f2418212d23`	affected	< 0a27bdb14b028fed30a10cec2f945c38cb5ca4fa

Linux

Linux

affected

Version	Status	Constraints
`6.16`	affected	—
`0`	unaffected	< 6.16
`6.17.8`	unaffected	≤ 6.17.*
`6.18`	unaffected	≤ *

No data.

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8029-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8030-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8029-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8048-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8029-3	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0a27bdb14b028fed30a10cec2f945c38cb5ca4fa
https://git.kernel.org/stable/c/6618243bcc3f60825f761a41ed65fef9fe97eb25
https://lore.kernel.org/linux-cve-announce/2025121651-CVE-2025-68309-1029@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-68309
https://www.cve.org/CVERecord?id=CVE-2025-68309

History

Wed, 17 Dec 2025 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025121651-CVE-2025-68309-1029@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-68309 https://www.cve.org/CVERecord?id=CVE-2025-68309
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Tue, 16 Dec 2025 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Fix NULL pointer access by aer_info The kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info->xxx will result in kernel panic. Fix it.
Title		PCI/AER: Fix NULL pointer access by aer_info
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0a27bdb14b028fed30a10cec2f945c38cb5ca4fa https://git.kernel.org/stable/c/6618243bcc3f60825f761a41ed65fef9fe97eb25

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-12-16T15:39:40.757Z

Updated: 2026-05-11T21:50:40.708Z

Reserved: 2025-12-16T14:48:05.294Z

Link: CVE-2025-68309

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2025-12-16T16:16:10.447

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-68309

Redhat

Severity : Moderate

Publid Date: 2025-12-16T00:00:00Z

Links: CVE-2025-68309 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68309", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T14:48:05.294Z", "datePublished": "2025-12-16T15:39:40.757Z", "dateUpdated": "2026-05-11T21:50:40.708Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:50:40.708Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/AER: Fix NULL pointer access by aer_info\n\nThe kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info->xxx\nwill result in kernel panic. Fix it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pci/pcie/aer.c"], "versions": [{"version": "a57f2bfb4a5863f83087867c0e671f2418212d23", "lessThan": "6618243bcc3f60825f761a41ed65fef9fe97eb25", "status": "affected", "versionType": "git"}, {"version": "a57f2bfb4a5863f83087867c0e671f2418212d23", "lessThan": "0a27bdb14b028fed30a10cec2f945c38cb5ca4fa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pci/pcie/aer.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6618243bcc3f60825f761a41ed65fef9fe97eb25"}, {"url": "https://git.kernel.org/stable/c/0a27bdb14b028fed30a10cec2f945c38cb5ca4fa"}], "title": "PCI/AER: Fix NULL pointer access by aer_info", "x_generator": {"engine": "bippy-1.2.0"}}}}