CVE-2025-68176 PCI: cadence: Check for the existence of cdns_pcie::ops before using it
A missing null check in the Linux kernel PCI Cadence driver can cause a system crash when specific hardware configurations are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68176?
CVE-2025-68176 is a vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PCI: cadence: Check for the existence of cdns_pcie::ops before using it
cdns_pcie::ops might not be populated by all the Cadence glue drivers. This is going to be true for the upcoming Sophgo platform which doesn't set the ops.
Hence, add a check to prevent NULL pointer dereference.
[mani: reworded subject and description]
Which versions are affected by CVE-2025-68176?
How do I fix CVE-2025-68176?
Apply the vendor's patch.
Is CVE-2025-68176 being exploited?
There is no known exploitation of CVE-2025-68176 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68176, DEBIAN-CVE-2025-68176, GHSA-79wh-89xp-4888, ROOT-OS-UBUNTU-2204-CVE-2025-68176, ROOT-OS-UBUNTU-2404-CVE-2025-68176, UBUNTU-CVE-2025-68176.