CVE-2025-68808

What it actually does

Uninitialized local pointers after memory ownership transfer in vidtv_channel_si_init() cause use-after-free and double-free when vidtv_psi_pmt_create_sec_for_each_pat_entry() and error paths invoke vidtv_psi_*_table_destroy() followed by vidtv_psi_*_event_destroy() on PAT/SDT/EIT tables.

Why it matters to the business

Kernel instability or crashes on systems using the vidtv virtual DVB driver; potential local privilege escalation in media-processing workloads, though low exploitability limits widespread operational disruption.

How an attack unfolds

An attacker triggers vidtv_channel_si_init() to allocate temporary program/service/event structures, transfers ownership without NULLing locals, then forces an error path (free_eit) so that subsequent destroy calls operate on already-freed memory, enabling double-free or use-after-free.

How to fix it

Upgrade the Linux kernel to the commit c342e294dac4988c8ada759b2f057246e48c5108 or later stable release containing the fix that initializes local pointers to NULL after ownership transfer.

How to confirm the fix worked

Verify the presence of commit c342e294dac4988c8ada759b2f057246e48c5108 in the kernel source tree or confirm that vidtv_channel_si_init() now explicitly sets pointers to NULL immediately after each vidtv_psi_*_assign() call.

Typical attack path

1. Obtain local access on a system with the vidtv module present or loadable
2. Trigger vidtv_channel_si_init() via media subsystem API or test harness
3. Induce failure in vidtv_psi_pmt_create_sec_for_each_pat_entry()
4. Force execution of free_eit cleanup path
5. Reuse or corrupt freed structures via dangling pointers

How to detect it

Search kernel logs and crash dumps for vidtv or media subsystem oops/panics referencing PAT/SDT/EIT table handling or double-free patterns; no widespread exploitation artifacts are known.

What your security team should do

• Apply the referenced kernel commit or newer stable release as soon as possible
• Disable or remove the vidtv module if not required in production
• Monitor kernel logs for media/vidtv-related oops or warnings during testing
• Include the fix in all downstream distribution updates and rebuilds