CVE-2025-68755 Linux CVE debrief

Who should care

Linux kernel maintainers, developers, and users who utilize the MOST subsystem or have the vulnerable driver present in their kernel configurations should assess their exposure and verify if the fix has been applied.

Why it matters

CVE-2025-68755 is a vulnerability in the Linux kernel's MOST I2C driver, which was removed due to a NULL pointer dereference issue. While the driver has been ineffective for five years, its removal impacts Linux kernel development and maintenance. Defenders should verify Linux kernel versions and system configurations for exposure.

• Verification of Linux kernel versions for the presence and fix of the MOST I2C driver.
• Assessment of system configurations for usage of the removed driver.
• Monitoring for potential NULL pointer dereference issues in other kernel drivers.

Technical summary

The Linux kernel's MOST I2C driver was removed due to a NULL pointer dereference vulnerability. The driver had been broken for five years without anyone noticing. The issue arose because the driver did not set the interface device pointer before registration, as required by a commit in 2018. This vulnerability impacts Linux kernel development and maintenance. Linux kernel maintainers, developers, and users who utilize the MOST subsystem or have the vulnerable driver present in their kernel configurations should assess their exposure and verify if the fix has been applied.

Defensive priority

Low priority, as the vulnerable driver has been removed.

Recommended defensive actions

• Review Linux kernel versions for the presence of the MOST I2C driver and verify if the fix has been applied.
• Check system configurations for any usage of the removed MOST I2C driver.
• Monitor for any potential NULL pointer dereference issues in other kernel drivers.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The official CVE Program record and NVD vulnerability detail page provide information on this vulnerability. Multiple source references from kernel.org are also available, detailing the commits that led to the removal of the broken driver.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.