CVE-2025-68766: Linux Kernel Privilege Escalation Flaw

CVE-2025-68766 Overview

CVE-2025-68766 is a vulnerability in the Linux kernel's irqchip/mchp-eic (Microchip External Interrupt Controller) driver. The flaw exists in the mchp_eic_domain_alloc() function where improper error handling can lead to an out-of-bounds memory access. When irq_domain_translate_twocell() sets the hwirq value to a number greater than or equal to MCHP_EIC_NIRQ (which is 2), the code checks for this invalid condition but fails to set the appropriate error code, returning success instead of -EINVAL.

Critical Impact

Out-of-bounds memory access in kernel interrupt handling could lead to system instability, denial of service, or potential privilege escalation on systems using Microchip External Interrupt Controller hardware.

Affected Products

• Linux kernel with irqchip/mchp-eic driver enabled
• Systems utilizing Microchip External Interrupt Controller hardware
• Embedded systems and SoCs with MCHP EIC components

Discovery Timeline

• 2026-01-05 - CVE CVE-2025-68766 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-68766

Vulnerability Analysis

This vulnerability is classified as an Out-of-Bounds Access issue stemming from an Input Validation Error in the Linux kernel's interrupt controller subsystem. The mchp_eic_domain_alloc() function is responsible for allocating interrupt domain resources for the Microchip External Interrupt Controller.

The function calls irq_domain_translate_twocell() to translate device tree interrupt specifications into hardware IRQ numbers. The code properly validates that the returned hwirq value must be less than MCHP_EIC_NIRQ (defined as 2), but when this validation fails, the function does not set an error return code. This oversight causes the function to return success (0) even when an invalid hardware IRQ number is provided, leading to subsequent out-of-bounds array accesses when the invalid hwirq value is used as an index.

Root Cause

The root cause is a missing error code assignment in the boundary validation logic. While the code correctly identifies when hwirq >= MCHP_EIC_NIRQ, it only logs an error or performs a check without setting the return value to -EINVAL. This is a classic case of incomplete error handling where the validation exists but the error propagation does not.

Attack Vector

The vulnerability can be triggered through malformed device tree configurations or by manipulating interrupt request parameters that cause irq_domain_translate_twocell() to return a hwirq value of 2 or greater. On systems with Microchip EIC hardware, an attacker with sufficient privileges to modify device tree overlays or interact with the interrupt subsystem could potentially trigger the out-of-bounds access.

The attack surface is limited to systems specifically using Microchip External Interrupt Controller hardware. Exploitation would require local access and the ability to influence interrupt domain allocation, typically requiring elevated privileges. The out-of-bounds access could lead to kernel memory corruption, information disclosure, or denial of service through a kernel panic.

Detection Methods for CVE-2025-68766

Indicators of Compromise

• Unexpected kernel panics or oops messages referencing the mchp_eic driver
• System logs showing errors in mchp_eic_domain_alloc() function
• Memory corruption warnings in kernel ring buffer related to IRQ domain operations
• Unusual interrupt allocation failures on systems with Microchip EIC hardware

Detection Strategies

• Monitor kernel logs for messages containing mchp_eic or irq_domain_translate_twocell errors
• Deploy kernel integrity monitoring to detect unexpected memory access patterns
• Use kernel address sanitizer (KASAN) in development environments to catch out-of-bounds accesses
• Implement audit logging for device tree modifications and interrupt subsystem operations

Monitoring Recommendations

• Enable kernel debugging options such as CONFIG_DEBUG_SLAB and CONFIG_KASAN where feasible
• Configure alerting on kernel oops or panic events in production monitoring systems
• Review system stability metrics for unexplained crashes on affected hardware platforms

How to Mitigate CVE-2025-68766

Immediate Actions Required

• Update to a patched Linux kernel version that includes the fix for CVE-2025-68766
• Review and validate device tree configurations on systems using Microchip EIC hardware
• Restrict access to device tree overlay mechanisms to trusted administrators only
• Monitor systems for signs of exploitation until patches can be applied

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that -EINVAL is returned when hwirq >= MCHP_EIC_NIRQ, properly propagating the error condition and preventing the out-of-bounds access. Multiple patch commits are available in the stable kernel tree:

• Kernel Git Commit 09efe7cf
• Kernel Git Commit 3873afcb
• Kernel Git Commit 7dbc0d40
• Kernel Git Commit efd65e2e

Workarounds

• If immediate patching is not possible, disable the mchp-eic driver if the hardware is not required
• Limit physical and logical access to systems with Microchip EIC hardware
• Implement additional access controls around device tree configuration files
• Consider using kernel live patching mechanisms if available for your distribution

# Check if mchp-eic driver is loaded
lsmod | grep mchp_eic

# Verify device tree nodes for mchp-eic
ls /proc/device-tree/ | grep -i eic

# Disable module loading if not required (temporary workaround)
echo "blacklist mchp_eic" >> /etc/modprobe.d/blacklist-mchp-eic.conf