CVE-2025-68220

Root

Cause

The vulnerability lies in the TI Keystone Navigator DMA (knav_dma) driver) API. The function knav_dma_open_channel does not consistently return NULL on failure. The header file include/linux/soc/ti/knav_dma.h declares that it returns NULL when the driver is disabled, but the actual implementation returns an uninitialized or ERR_PTR value on error. This inconsistency causes callers, specifically netcp_free_navigator_resources, to treat a non-NULL error pointer as a valid channel, leading to a crash when knav_dma_close_channel is called on that invalid pointer [1].

Exploitation

The bug is triggered during the network interface open sequence (netcp_ndo_open). When knav_dma_open_channel fails, it returns an invalid pointer instead of NULL. The caller netcp_free_navigator_resources then passes this pointer to knav_dma_close_channel, which dereferences it, causing an alignment exception and kernel panic. The attack surface is local; an attacker with the ability to trigger a network interface open (e.g., via ip link set up) on a system with the TI NetCP driver can cause a denial of service. No authentication is required beyond local access to the network interface [1].

Impact

A successful exploit results in a denial of service (system crash) due to a kernel NULL pointer dereference or alignment fault. The crash trace shows an "Unhandled fault: alignment exception" at address 0xfffffff2, indicating the invalid pointer was used as a channel handle. This can lead to system unavailability, especially during boot if the interface is brought up automatically [1].

Mitigation

The fix standardizes knav_dma_open_channel to return NULL on all error conditions, ensuring callers can safely check for failure. The patch has been applied to the Linux kernel stable tree. Users should update to a update to a kernel version containing the commit af6b10a13fc0 or later. No workaround is available other than avoiding the use of the affected driver or network interface [1].