CVE-2025-68238

Low risk· EPSS 8%

Published: 16/12/2025(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

In the Linux kernel, the mtd rawnand cadence driver dereferenced the DMA device pointer dma_dev before ensuring cdns_ctrl->dmac was properly initialized. The fix moves the assignment of dma_dev after successfully acquiring the DMA channel.

Risk Assessment

A NULL pointer dereference can occur, leading to a kernel crash (oops) and denial of service. Affects systems using the Cadence NAND controller.

Recommendation

Update the Linux kernel to a version containing the mtd rawnand cadence driver fix.

Other vulnerabilities in Linux kernel (mtd rawnand cadence)

CVE-2026-98721Low risk· EPSS 10%
In the Linux kernel's Cadence NAND driver (mtd: rawnand), the interrupt handler is registered before the IRQ lock and completion object are initialized. This leaves a window where a pending interrupt can access uninitialized synchronization state.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: fix DMA device NULL pointer dereference The DMA device pointer `dma_dev` was being dereferenced before ensuring that `cdns_ctrl->dmac` is properly initialized. Move the assignment of `dma_dev` after successfully acquiring the DMA channel to ensure the pointer is valid before use.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS