CVE-2025-68205 ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver
A null pointer dereference in the Linux kernel's ALSA HDMI driver causes a system crash when probing the nvhdmi-mcp driver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68205?
CVE-2025-68205 is a vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver
After restructuring and splitting the HDMI codec driver code, each HDMI codec driver contains the own build_controls and build_pcms ops. A copy-n-paste error put the wrong entries for nvhdmi-mcp driver; both build_controls and build_pcms are swapped. Unfortunately both callbacks have the very same form, and the compiler didn't complain it, either. This resulted in a NULL dereference because the PCM instance hasn't been initialized at calling the build_controls callback.
Fix it by passing the proper entries.
Which versions are affected by CVE-2025-68205?
How do I fix CVE-2025-68205?
Apply the vendor's patch.
Is CVE-2025-68205 being exploited?
There is no known exploitation of CVE-2025-68205 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68205, DEBIAN-CVE-2025-68205, GHSA-fp57-xr9h-hfc8, UBUNTU-CVE-2025-68205.