CVE-2025-68808

Vulnerability

Overview

In the Linux kernel's media subsystem, the vidtv driver's vidtv_channel_si_init() function creates temporary lists (program, service, event) and transfers memory ownership to PAT, SDT, and EIT tables via vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign(), and vidtv_psi_eit_event_assign(). However, after the transfer, the local pointers are not set to NULL, leading to a double-free vulnerability when error handling paths call both vidtv_psi_*_table_destroy() and vidtv_psi_*_event_destroy() on the same memory. The uninitialized pointer can still reference freed memory, resulting in a use-after-free scenario [1][2][3].

Exploitation

Conditions

An attacker would need to trigger an error condition in the vidtv driver's initialization flow, specifically within vidtv_psi_pmt_create_sec_for_each_pat_entry(), that causes the code to jump to the free_eit label. At that point, the memory freed by vidtv_psi_*_table_destroy() may be accessed again by vidtv_psi_*_event_destroy() due to the stale local pointer. No special privileges or network access are required beyond the ability to interact with the driver through the V4L2 media API, but exploitation depends on inducing a specific error path during channel setup.

Impact

Successful exploitation can lead to memory corruption, including a double-free condition that can be leveraged for privilege escalation or denial of service. The use-after-free aspect could allow an attacker to manipulate kernel memory, potentially resulting in arbitrary code execution in the kernel context, though the primary risk is system instability or local privilege escalation.

Mitigation

Status

The fix for this vulnerability has been applied to the Linux kernel stable tree in commits a69c7fd603bf5ad93177394fbd9711922ee81032, 12ab6ebb37789b84073e83e4d9b14a5e0d133323, and 3caa9f9b4e (references [1], [2], [3] respectively). Users should update to the latest kernel version that includes these patches. No workaround is available beyond applying the security update.