CVE-2025-68237

What it actually does

Integer overflow in mtdchar ioctl handling where u64 req.start can exceed U32_MAX when added to masked req.len, bypassing intended bounds checks on user-supplied values.

Why it matters to the business

Local attackers on Linux systems using MTD devices could trigger kernel memory corruption leading to crashes or privilege escalation; low prevalence and stable low exploit probability limit widespread operational disruption.

How an attack unfolds

An attacker with local access sends crafted MTD_IOC requests containing large req.start values to the mtdchar driver; the unchecked addition overflows, allowing out-of-bounds operations that may corrupt kernel memory or enable further exploitation.

How to fix it

Upgrade the Linux kernel to commit f37efdd97fd1ec3e0d0f1eec279c8279e28f981e or later; for affected Chainguard firefox-esr packages, upgrade to version 128.7.0-r0.

How to confirm the fix worked

Verify the presence of check_add_overflow() usage in mtdchar.c and confirm kernel builds from the fixed commit; test ioctl paths with maximum u64 values to ensure no overflow occurs.

Typical attack path

1. Obtain local access on a system exposing mtdchar devices
2. Issue ioctl calls with malicious u64 start and len parameters
3. Trigger integer overflow during start+len calculation
4. Leverage resulting memory corruption for denial of service or privilege escalation

How to detect it

Review kernel audit logs and dmesg for mtdchar ioctl failures or memory fault patterns; correlate with processes issuing MTD_IOC_* requests on character devices.

What your security team should do

• Apply the referenced kernel patch or updated package immediately on all systems exposing MTD character devices
• Audit and restrict unprivileged access to /dev/mtd* nodes
• Monitor kernel logs for mtdchar-related faults or unusual ioctl activity