CVE-2025-68808: Linux Kernel Use-After-Free Vulnerability

CVE-2025-68808 Overview

CVE-2025-68808 is a memory safety vulnerability in the Linux kernel's vidtv (Virtual Digital TV) media driver. The flaw resides in the vidtv_channel_si_init() function, which builds temporary lists for programs, services, and events. Ownership of those allocations is transferred to the PAT, SDT, and EIT tables through vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign(), and vidtv_psi_eit_event_assign(). Because the local pointers are not reset to NULL after ownership transfer, a failure in vidtv_psi_pmt_create_sec_for_each_pat_entry() triggers cleanup that frees the same memory twice. This results in both a use-after-free and a double-free condition in kernel memory.

Critical Impact
Local triggering of the vulnerable error path can corrupt kernel heap state, leading to potential denial of service or memory corruption that could be leveraged for privilege escalation.

Affected Products

Linux kernel media: vidtv driver (Virtual Digital TV test driver)
Multiple stable kernel branches addressed via the commits listed in references
Distributions shipping affected kernel versions with the vidtv module enabled

Discovery Timeline

2026-01-13 - CVE-2025-68808 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-68808

Vulnerability Analysis

The vidtv driver constructs Service Information (SI) tables used by DVB to describe channels, programs, and events. During initialization, vidtv_channel_si_init() allocates temporary structures and transfers their ownership to higher-level table objects through three assignment helpers. After ownership transfer, the original local pointers continue to hold references to memory that now belongs to the PAT, SDT, and EIT tables.

When vidtv_psi_pmt_create_sec_for_each_pat_entry() fails, control flow jumps to the free_eit error label. The cleanup path calls vidtv_psi_*_table_destroy(), which frees the table along with the structures it now owns. The subsequent calls to vidtv_psi_*_event_destroy() then operate on the still-populated local pointers, accessing memory that has already been released and freeing it a second time.

Root Cause

The root cause is missing pointer hygiene after a transfer of ownership. The local variables holding the program, service, and event lists are not set to NULL once vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign(), and vidtv_psi_eit_event_assign() complete. The cleanup routines have no way to distinguish between owned and transferred memory, so they re-process freed allocations. The condition combines both a use-after-free read and a double-free of the same kernel objects [CWE-416, CWE-415].

Attack Vector

Triggering the bug requires local access to a system with the vidtv driver loaded and reachable. An attacker capable of invoking the initialization path under conditions that cause vidtv_psi_pmt_create_sec_for_each_pat_entry() to fail can force the kernel into the vulnerable cleanup sequence. Successful exploitation corrupts the kernel slab allocator state. Heap grooming techniques targeting freed slab objects could turn this primitive into a vector for privilege escalation, though the most direct consequence is kernel instability.

No verified public proof-of-concept code is available. The vulnerability is described in prose based on the upstream patch commits referenced by the Linux kernel maintainers.

Detection Methods for CVE-2025-68808

Indicators of Compromise

Kernel oops or panic logs referencing vidtv_psi_pat_program_destroy, vidtv_psi_sdt_service_destroy, or vidtv_psi_eit_event_destroy in the call trace
KASAN reports flagging use-after-free or double-free events inside the vidtv module
Unexpected loading of the vidtv kernel module on production hosts where DVB testing is not in scope

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in test and staging kernels to catch the unsafe free pattern during driver initialization
Audit kernel module load events for vidtv on systems that do not require DVB virtual hardware
Correlate kernel crash dumps with the affected function symbols to identify exploitation attempts or reliability impact

Monitoring Recommendations

Collect and centralize dmesg and /var/log/kern.log output for analysis of vidtv-related stack traces
Alert on modprobe or insmod activity targeting vidtv outside of authorized maintenance windows
Track kernel version inventory across the fleet to identify hosts running unpatched stable branches

How to Mitigate CVE-2025-68808

Immediate Actions Required

Apply the upstream Linux kernel patches that initialize the local pointers to NULL after ownership transfer in vidtv_channel_si_init()
Update to a stable kernel release that includes the fix, referencing the commits below
Blacklist the vidtv module on systems that do not require it until patches are deployed

Patch Information

The issue is resolved across multiple stable branches by patches that set local pointers to NULL immediately after vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign(), and vidtv_psi_eit_event_assign() succeed. Relevant fix commits include Linux Kernel Commit 12ab6eb, Linux Kernel Commit 30f4d4e, Linux Kernel Commit 3caa18d, Linux Kernel Commit 98aabfe, Linux Kernel Commit a69c7fd, Linux Kernel Commit c342e29, and Linux Kernel Commit fb9bd6d.

Workarounds

Prevent vidtv from loading by adding it to the kernel module blacklist on production systems
Restrict access to DVB device nodes under /dev/dvb/ to trusted administrators only
Disable CONFIG_DVB_VIDTV when building custom kernels for environments that do not need the virtual DVB driver

bash

# Blacklist the vidtv module to block load attempts
echo "blacklist vidtv" | sudo tee /etc/modprobe.d/blacklist-vidtv.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep vidtv