CVE-2025-68235

What it actually does

A memory leak occurs in the Nouveau kernel driver because nvkm_falcon_fw::boot is allocated during firmware handling but never freed with kfree, producing a kmemleak warning.

Why it matters to the business

Gradual kernel memory consumption on systems with NVIDIA GPUs using the open-source Nouveau driver can lead to increased memory pressure and occasional reboots; low EPSS and lack of KEV listing indicate limited operational urgency despite the 315-day-old issue.

How an attack unfolds

An attacker would repeatedly trigger Nouveau firmware initialization paths to amplify the leak, but no threat actors or ransomware campaigns have been associated and exploitation maturity remains none.

How to fix it

Upgrade the Linux kernel to a version containing commit 7d1977b4ae5c50e1aafc5c51500fc08bd7afd6a0; for falcoctl-fips-0.4 update to 0.4.0-r16.

How to confirm the fix worked

Confirm the presence of the referenced commit in the running kernel source or verify package version; run kmemleak scans and confirm absence of warnings for nvkm_falcon_fw::boot.

Typical attack path

1. Load or reload Nouveau firmware objects
2. Trigger nvkm_falcon_fw allocation paths
3. Observe cumulative unreleased kernel memory

How to detect it

Inspect kernel logs and kmemleak output for references to nvkm_falcon_fw::boot; correlate with Nouveau module load events on systems running unpatched kernels.

• nvkm_falcon_fw::boot
• kmemleak.*nvkm_falcon_fw
• unreferenced object.*falcon_fw

What your security team should do

• Apply the listed kernel or package updates on all affected systems
• Enable and periodically review kmemleak reports on GPU hosts
• Monitor memory utilization trends for Nouveau-based workloads