Vulnerability in Linux

CVE-2025-68303

In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel: punit_ipc: fix memory corruption This passes the address of the pointer "&punit_ipcdev" when the intent was to pass the pointer itself "punit_ipcdev" (without the ampersand). This means that the: complete(&ipcdev->cmd_complete); in intel_punit_ioc() will write to a wrong memory address corrupting it.

EPSS: 0.002 (6.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Linux — versions fdca4f16f57da76a8e68047923588a87d1c01f0a, 4.5, 0

References

Frequently asked questions

What is CVE-2025-68303?
CVE-2025-68303 is a high-severity vulnerability in Linux. CVSS score: 7.8/10. Published 2025-12-16.
How severe is CVE-2025-68303?
High severity. CVSS v3 base score is 7.8 out of 10.