Linux Kernel up to 6.18.1 amdxdna aie2_query_ctx_status_array integer overflow

Summaryinfo

A vulnerability described as critical has been identified in Linux Kernel up to 6.18.1. Affected by this issue is the function aie2_query_ctx_status_array of the component amdxdna. The manipulation results in integer overflow. This vulnerability is identified as CVE-2025-68731. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.1. Affected is the function aie2_query_ctx_status_array of the component amdxdna. The manipulation with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array() The unpublished smatch static checker reported a warning. drivers/accel/amdxdna/aie2_pci.c:904 aie2_query_ctx_status_array() warn: potential user controlled sizeof overflow 'args->num_element * args->element_size' '1-u32max(user) * 1-u32max(user)' Even this will not cause a real issue, it is better to put a reasonable limitation for element_size and num_element. Add condition to make sure the input element_size <= 4K and num_element <= 1K.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2025-68731 since 12/24/2025. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 12/26/2025).

The vulnerability scanner Nessus provides a plugin with the ID 280066 (Linux Distros Unpatched Vulnerability : CVE-2025-68731), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.2 or 6.19-rc1 eliminates this vulnerability. Applying the patch 359653edd5374fbba28f93043554dcc494aee85f/9e16c8bf9aebf629344cfd4cd5e3dc7d8c3f7d82 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (280066) and CERT Bund (WID-SEC-2025-2920). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion