CVE-2025-68198

What it actually does

Incorrect resource object selection in __crash_shrink_memory causes invalid crashk_res updates when high crashkernel is resized below low reservation, leading to stale iomem entries and NULL pointer dereference on subsequent shrinks.

Why it matters to the business

Linux systems configured with crashkernel high reservations risk kernel panics during memory size adjustments, disrupting crash dump capability and causing unplanned downtime on servers using kexec/kdump.

How an attack unfolds

An attacker with write access to /sys/kernel/kexec_crash_size issues repeated smaller values for a high crashkernel reservation; the second shrink triggers __release_resource on a freed or wrong object, producing a NULL dereference panic.

How to fix it

Upgrade to kernels containing commit f01f9c348d76d40bf104a94449e3ce4057fdefee; for Chainguard src-fingerprint-fips update to 0.19.0-r9 or newer. Restrict write access to /sys/kernel/kexec_crash_size until patched.

How to confirm the fix worked

Confirm the fix commit is present in the running kernel tree; perform repeated crashkernel size reductions via sysfs and verify no NULL dereference oops occurs and /proc/iomem reflects correct reservations.

Typical attack path

1. Obtain local privileges sufficient to write kexec_crash_size sysfs file
2. Configure or observe an existing high crashkernel reservation
3. Write a reduced size value that drops below the low reservation
4. Repeat the write to force double-shrink path
5. Trigger kernel NULL pointer dereference in resource release

How to detect it

Search kernel logs for oops traces containing __release_resource, release_resource, __crash_shrink_memory or crash_shrink_memory; correlate with writes to /sys/kernel/kexec_crash_size in auditd or syscall logs.

What your security team should do

• Apply the referenced kernel commit or package update on all affected systems immediately
• Limit CAP_SYS_ADMIN or equivalent privileges that allow writing kexec sysfs files
• Add monitoring for crash_core related oops entries in kernel logs
• Document crashkernel configurations and test shrink operations in lab environments