CVE-2025-68797

Vulnerability

In the Linux kernel, a NULL pointer dereference vulnerability exists in the applicom character driver's ac_ioctl function. The root cause is a missing validation check: when the IOCTL command is 6 (a global information query), the code bypasses the normal validation of IndexCard and the corresponding RamIO pointer. Despite this, the function unconditionally executes readb(apbs[IndexCard].RamIO + VERS) at the end, which dereferences a potentially NULL RamIO pointer if the referenced board does not exist [1].

Exploitation

An unprivileged local user with access to the /dev/com_x device file (or equivalent) can trigger this vulnerability by issuing an IOCTL with command code 6 and an IndexCard value that references a non-existent board. The attacker does not require special privileges beyond the ability to open and use the applicable character device [1].

Impact

Successful exploitation leads to a NULL pointer dereference, which crashes the kernel and causes a denial of service (DoS) on the affected system. The attacker cannot execute arbitrary code or elevate privileges, but can reliably crash the machine [1].

Mitigation

This vulnerability was fixed in the Linux kernel by skipping the readb access when the IOCTL command is 6. Patched versions are available via the stable kernel trees. System administrators should apply the latest kernel updates from their Linux distribution [1].