CVE-2025-68303

Root

Cause

The vulnerability resides in the intel_punit_ipc driver. In the code path that handles IPC command completion, the address of the pointer &punit_ipcdev is passed instead of the pointer punit_ipcdev itself. This causes the complete(&ipcdev->cmd_complete) call in intel_punit_ioc() to write to a wrong memory address, corrupting kernel memory [1][2][3].

Exploitation

An attacker with local access and the ability to interact with the Intel P-Unit IPC interface (e.g., through a device file or kernel API) could trigger this bug. The exact prerequisites are not detailed, but the corruption occurs during normal IPC completion handling, making it reachable from code paths that submit IPC commands.

Impact

Memory corruption can lead to system instability, denial of service (kernel panic), or potentially privilege escalation if the corrupted memory region contains security-critical data or function pointers.

Mitigation

The fix was applied in the mainline kernel and backported to stable branches. Users should update to a kernel version containing the commit that corrects the pointer dereference. The stable backports are referenced in [1], [2], and [3].