CVE-2025-68311

What it actually does

Missing device pointer in uart_port structure for ip22zilog serial driver causes NULL dereference and kernel oops after runtime PM changes in serial core.

Why it matters to the business

Unexpected system crashes on affected legacy SGI IP22 hardware reduce availability and require emergency reboots or kernel updates.

How an attack unfolds

An attacker with local access loads or triggers the ip22zilog driver on vulnerable kernels; the missing dev pointer leads to immediate kernel oops and denial of service.

How to fix it

Update to fixed kernel versions including commit 460e0dc9af2d7790d5194c6743d79f9b77b58836 or Ubuntu package 2.20.11-1 and later; rebuild and reboot with updated kernel.

How to confirm the fix worked

Confirm kernel source contains the platform device probing changes for ip22zilog; test driver load on target hardware without triggering oops.

Typical attack path

1. Obtain local access on SGI IP22 system
2. Trigger serial driver initialization or device probe
3. Kernel dereferences unset uart_port.dev pointer
4. System oops and crashes

How to detect it

Review kernel logs for oops traces referencing ip22zilog or uart_port during driver probe; check dmesg and syslog for serial core warnings after the runtime PM commit.

What your security team should do

• Apply kernel updates to fixed versions immediately on any IP22 systems
• Disable unused legacy serial drivers via kernel config if hardware is not required
• Monitor for kernel oops reports in system logs on affected platforms