CVE-2025-68201

What it actually does

Userspace-supplied input can trigger two invalid BUG_ON assertions inside the amdgpu DRM driver, causing an immediate kernel panic and denial of service.

Why it matters to the business

Unprivileged processes can force Linux systems that use AMD GPUs to reboot or halt, disrupting workloads and availability; the large number of container images that embed the affected kernel increases the blast radius across development and production environments.

How an attack unfolds

An attacker with a local or containerized process on a vulnerable system issues graphics or DRM ioctl calls that exercise the code paths containing the invalid BUG_ON checks; the assertions fire, the kernel panics, and the system becomes unavailable. No remote network access or elevated privileges are required.

How to fix it

Upgrade affected packages to the versions that contain commit eaf12bffd7f79f4d46ec028706f9d1a2d90f46fd or later: gitlab-cng-fips-17.8, gitlab-base-fips-17.8, gitlab-container-registry-fips-17.8, gitlab-elasticsearch-indexer-fips-17.8, gitlab-logger-fips-17.8, gitlab-shell-fips-17.8 and gitlab-toolbox-fips-17.8 to 17.8.2-r0; rebuild or redeploy any derived container images from the fixed Chainguard base layers.

How to confirm the fix worked

Confirm the running kernel contains commit eaf12bffd7f79f4d46ec028706f9d1a2d90f46fd; attempt to exercise the previously triggering DRM paths from an unprivileged process and verify that no BUG_ON panic occurs.

Typical attack path

1. Obtain local execution on a system running a vulnerable amdgpu kernel
2. Open a DRM device handle or issue userspace graphics commands that reach the buggy assertion sites
3. Trigger the BUG_ON conditions to induce kernel panic
4. Repeat to sustain denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for amdgpu-related BUG_ON messages or sudden kernel panics on systems exposing /dev/dri or DRM devices; correlate process execution that opens DRM file descriptors immediately before the crash.

What your security team should do

• Prioritize patching of any systems or container images that include the vulnerable amdgpu driver within the next maintenance window
• Add kernel version checks to image build pipelines and CI to block deployment of the affected Chainguard layers
• Monitor EPSS trend and re-evaluate if exploit maturity increases