LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68797: char: applicom: fix NULL pointer dereference in ac_ioctl

In the Linux kernel, the following vulnerability has been resolved: char: applicom: fix NULL pointer dereference in ac_ioctl Discovered by Atuin - Automated Vulnerability Discovery Engine. In ac_ioctl, the validation of IndexCard and the check for a valid RamIO pointer are skipped when cmd is 6. However, the function unconditionally executes readb(apbs[IndexCard].RamIO + VERS) at the end. If cmd is 6, IndexCard may reference a board that does not exist (where RamIO is NULL), leading to a NULL pointer dereference. Fix this by skipping the readb access when cmd is 6, as this command is a global information query and does not target a specific board context.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-68797 is a Linux kernel bug in the applicom character driver. A specific ioctl path can trigger a NULL pointer dereference, which typically means a kernel crash or denial of service. The public record does not provide CVSS scoring, confirmed exploitation, or evidence of remote attackability.

Executive priority

Treat as a routine but real availability risk for Linux assets using the applicom driver. Prioritize patch validation on industrial, legacy, or specialized systems where applicom hardware support may exist. There is no public evidence of broad active exploitation in the provided sources.

Technical view

In ac_ioctl, command 6 bypasses IndexCard validation and the RamIO pointer check, but the function later unconditionally reads from apbs[IndexCard].RamIO + VERS. If the referenced board does not exist, RamIO can be NULL. The kernel fix skips that read for command 6 because it is a global information query.

Likely exposure

Exposure is likely limited to Linux systems where the applicom character driver is present, enabled, and reachable through its ioctl interface. Systems without this driver or without accessible device nodes are less likely to be exposed. The source does not identify affected distributions or default configurations.

Exploitation context

No KEV listing or cited source indicates active exploitation. The described path is an ioctl handler, so practical exploitation appears dependent on local access to the relevant driver interface. The public sources do not claim remote exploitation, privilege escalation, or data disclosure.

Researcher notes

The record lacks CVSS, CWE, and distribution-specific impact. Version metadata is limited, so use the kernel stable commits and downstream vendor advisories to map exposure. The fix is narrowly scoped to avoiding a NULL read path for command 6.

Mitigation direction

  • Apply Linux kernel updates that include the referenced stable fixes.
  • Check your distribution kernel advisory for the backported fix status.
  • If applicom is unnecessary, review vendor-supported options to disable or remove it.

Validation and detection

  • Inventory Linux kernel versions and downstream package advisories.
  • Determine whether the applicom driver is built, loaded, or available.
  • Confirm the relevant stable commit or backport is present.
  • Review device exposure and access policy for applicom interfaces.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68797 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2unaffected
LinuxLinux2.6.12, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.