CVE-2025-68198
- Source
- https://cve.org/CVERecord?id=CVE-2025-68198
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68198.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-68198
- Aliases
- Downstream
- Related
- Published
- 2025-12-16T13:48:26.998Z
- Modified
- 2026-01-30T00:32:44.554619Z
- Summary
- crash: fix crashkernel resource shrink
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
crash: fix crashkernel resource shrink
When crashkernel is configured with a high reservation, shrinking its value below the low crashkernel reservation causes two issues:
- Invalid crashkernel resource objects
- Kernel crash if crashkernel shrinking is done twice
For example, with crashkernel=200M,high, the kernel reserves 200MB of high memory and some default low memory (say 256MB). The reservation appears as:
cat /proc/iomem | grep -i crash af000000-beffffff : Crash kernel 433000000-43f7fffff : Crash kernel
If crashkernel is then shrunk to 50MB (echo 52428800 > /sys/kernel/kexeccrashsize), /proc/iomem still shows 256MB reserved: af000000-beffffff : Crash kernel
Instead, it should show 50MB: af000000-b21fffff : Crash kernel
Further shrinking crashkernel to 40MB causes a kernel crash with the following trace (x86):
BUG: kernel NULL pointer dereference, address: 0000000000000038 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI <snip...> Call Trace: <TASK> ? _diebody.cold+0x19/0x27 ? pagefaultoops+0x15a/0x2f0 ? searchmoduleextables+0x19/0x60 ? searchbpfextables+0x5f/0x80 ? excpagefault+0x7e/0x180 ? asmexcpagefault+0x26/0x30 ? _releaseresource+0xd/0xb0 releaseresource+0x26/0x40 _crashshrinkmemory+0xe5/0x110 crashshrinkmemory+0x12a/0x190 kexeccrashsizestore+0x41/0x80 kernfsfopwriteiter+0x141/0x1f0 vfswrite+0x294/0x460 ksys_write+0x6d/0xf0 <snip...>
This happens because _crashshrinkmemory()/kernel/crashcore.c incorrectly updates the crashkres resource object even when crashklow_res should be updated.
Fix this by ensuring the correct crashkernel resource object is updated when shrinking crashkernel memory.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68198.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/00fbff75c5acb4755f06f08bd1071879c63940c5
- https://git.kernel.org/stable/c/a2bd247f8c6c5ac3f0ba823a2fffd77bb9cdf618
- https://git.kernel.org/stable/c/f01f9c348d76d40bf104a94449e3ce4057fdefee
- https://git.kernel.org/stable/c/f89c5e7077f63e45e8ba5a77b7cf0803130367e6
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68198.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-68198
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced16c6006af4d4e70ecef93977a5314409d931020bFixedf01f9c348d76d40bf104a94449e3ce4057fdefeeFixedf89c5e7077f63e45e8ba5a77b7cf0803130367e6Fixeda2bd247f8c6c5ac3f0ba823a2fffd77bb9cdf618Fixed00fbff75c5acb4755f06f08bd1071879c63940c5