CVE-2025-68238

What it actually does

The vulnerability is a NULL pointer dereference in the Linux kernel Cadence raw NAND driver where dma_dev is accessed before confirming cdns_ctrl->dmac has been successfully initialized during DMA channel acquisition.

Why it matters to the business

Systems with Cadence NAND hardware on affected kernels can suffer sudden kernel crashes during storage initialization, resulting in downtime, interrupted boot processes, and potential loss of data in flight for affected devices.

How an attack unfolds

An attacker with local access loads or triggers the mtd rawnand cadence driver on hardware lacking proper DMA setup, causing the uninitialized pointer dereference and kernel panic before any mitigation can occur.

How to fix it

Upgrade the Linux kernel to version 5.10.247 or later, or apply commit 2178b0255eae108bb10e5e99658b28641bc06f43. For kubernetes-dns-node-cache packages update to 1.25.0-r1 in both Chainguard and Wolfi distributions.

How to confirm the fix worked

Confirm the running kernel is 5.10.247 or newer, verify the fix commit is present in the driver source, and test NAND device initialization on Cadence hardware to ensure no crash occurs.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Trigger loading or initialization of the Cadence NAND controller driver
3. Force DMA channel acquisition path with uninitialized dmac
4. Trigger NULL pointer dereference leading to kernel panic

How to detect it

Search kernel logs and dmesg output for oops or panic messages referencing cadence, rawnand, dma_dev, or dmac initialization failures around device probe times.

What your security team should do

• Prioritize kernel upgrades on all systems using Cadence NAND controllers
• Reboot affected hosts after patching to activate the fixed driver
• Review boot and kernel logs for prior crashes mentioning rawnand or cadence DMA
• Restrict unprivileged access to MTD/NAND device nodes until patched