CVE-2025-68808

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

media: vidtv: initialize local pointers upon transfer of memory ownership

vidtv_channel_si_init() creates a temporary list (program, service, event)

and ownership of the memory itself is transferred to the PAT/SDT/EIT

tables through vidtv_psi_pat_program_assign(),

vidtv_psi_sdt_service_assign(), vidtv_psi_eit_event_assign().

The problem here is that the local pointer where the memory ownership

transfer was completed is not initialized to NULL. This causes the

vidtv_psi_pmt_create_sec_for_each_pat_entry() function to fail, and

in the flow that jumps to free_eit, the memory that was freed by

vidtv_psi_*_table_destroy() can be accessed again by

vidtv_psi_*_event_destroy() due to the uninitialized local pointer, so it

is freed once again.

Therefore, to prevent use-after-free and double-free vulnerability,

local pointers must be initialized to NULL when transferring memory

ownership.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References