CVE-2025-68167

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: fix invalid pointer access in debugfs

If the memory allocation in gpiolib_seq_start() fails, the s->private field remains uninitialized and is later dereferenced without checking in gpiolib_seq_stop(). Initialize s->private to NULL before calling kzalloc() and check it before dereferencing it.

Moderate severity is assigned to this flaw because exploitation requires privileged local access to debugfs, which is restricted to administrative users by default on Red Hat Enterprise Linux. In typical deployment models, unprivileged users cannot interact with the debugfs filesystem to trigger the affected code path. Furthermore, the issue only manifests if a system memory allocation fails during debug sequence operations, limiting the impact to a local denial of service via kernel panic. The lack of remote reachability and the requirement for administrative privileges prevent a higher severity rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.