CVE-2025-68309 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved:

PCI/AER: Fix NULL pointer access by aer_info

The kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info->xxx
will result in kernel panic. Fix it.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00027.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

Linux

unaffected

Version	Status	Constraints
`a57f2bfb4a5863f83087867c0e671f2418212d23`	affected	< 6618243bcc3f60825f761a41ed65fef9fe97eb25
`a57f2bfb4a5863f83087867c0e671f2418212d23`	affected	< 0a27bdb14b028fed30a10cec2f945c38cb5ca4fa

Linux

Linux

affected

Version	Status	Constraints
`6.16`	affected	—
`0`	unaffected	< 6.16
`6.17.8`	unaffected	≤ 6.17.*
`6.18`	unaffected	≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors	Products
Linux Subscribe	Linux Kernel Subscribe

Advisories

Source	ID	Title
Ubuntu USN	USN-8029-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8030-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8029-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8048-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8029-3	Linux kernel (Azure) vulnerabilities

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://git.kernel.org/stable/c/0a27bdb14b028fed30a10cec2f945c38cb5ca4fa
https://git.kernel.org/stable/c/6618243bcc3f60825f761a41ed65fef9fe97eb25
https://lore.kernel.org/linux-cve-announce/2025121651-CVE-2025-68309-1029@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-68309
https://www.cve.org/CVERecord?id=CVE-2025-68309

History

Wed, 17 Dec 2025 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025121651-CVE-2025-68309-1029@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-68309 https://www.cve.org/CVERecord?id=CVE-2025-68309
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Tue, 16 Dec 2025 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Fix NULL pointer access by aer_info The kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info->xxx will result in kernel panic. Fix it.
Title		PCI/AER: Fix NULL pointer access by aer_info
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0a27bdb14b028fed30a10cec2f945c38cb5ca4fa https://git.kernel.org/stable/c/6618243bcc3f60825f761a41ed65fef9fe97eb25

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-12-16T15:39:40.757Z

Updated: 2026-01-02T15:34:53.785Z

Reserved: 2025-12-16T14:48:05.294Z

Link: CVE-2025-68309

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2025-12-16T16:16:10.447

Modified: 2025-12-18T15:08:06.237

Link: CVE-2025-68309

Redhat

Severity : Moderate

Publid Date: 2025-12-16T00:00:00Z

Links: CVE-2025-68309 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68309", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T14:48:05.294Z", "datePublished": "2025-12-16T15:39:40.757Z", "dateUpdated": "2026-01-02T15:34:53.785Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-01-02T15:34:53.785Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/AER: Fix NULL pointer access by aer_info\n\nThe kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info->xxx\nwill result in kernel panic. Fix it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pci/pcie/aer.c"], "versions": [{"version": "a57f2bfb4a5863f83087867c0e671f2418212d23", "lessThan": "6618243bcc3f60825f761a41ed65fef9fe97eb25", "status": "affected", "versionType": "git"}, {"version": "a57f2bfb4a5863f83087867c0e671f2418212d23", "lessThan": "0a27bdb14b028fed30a10cec2f945c38cb5ca4fa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pci/pcie/aer.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6618243bcc3f60825f761a41ed65fef9fe97eb25"}, {"url": "https://git.kernel.org/stable/c/0a27bdb14b028fed30a10cec2f945c38cb5ca4fa"}], "title": "PCI/AER: Fix NULL pointer access by aer_info", "x_generator": {"engine": "bippy-1.2.0"}}}}