PT-2026-2521 · Linux · Linux Kernel

Published 2025-12-10 · Updated 2026-05-26 · CVE-2025-68789

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The ibmpex high low store() function in the Linux kernel does not validate driver data retrieved using dev get drvdata(). This creates a race condition where the sysfs callback can be invoked after the data structure is freed, leading to a use-after-free issue. The fix involves adding a NULL check after dev get drvdata() and reordering operations in the deletion path to prevent TOCTOU (Time-of-Check to Time-of-Use).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2026-00732

CVE-2025-68789

ECHO-A798-22A8-66DD

MGASA-2026-0017

MGASA-2026-0018

OPENSUSE-SU-2026:20287-1

SUSE-SU-2026:0447-1

SUSE-SU-2026:0472-1

SUSE-SU-2026:0587-1

SUSE-SU-2026:20477-1

SUSE-SU-2026:20498-1

SUSE-SU-2026:20555-1

SUSE-SU-2026:20599-1

SUSE-SU-2026:20615-1

SUSE-SU-2026:20845-1

SUSE-SU-2026:20876-1

Affected Products

Linux Kernel

References · 1617

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68789.json · Exploit
• https://bdu.fstec.ru/vul/2026-00732 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2025-68789 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20477-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20876-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68789 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-68789 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20287-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-68789 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2025-68789 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0472-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0018 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0447-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68789 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20615-1 · Vendor Advisory