CVE-2025-68731

Source
https://cve.org/CVERecord?id=CVE-2025-68731
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68731.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-68731
Downstream
Related
Published
2025-12-24T10:33:13.964Z
Modified
2026-03-23T05:12:38.057847255Z
Summary
accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array()
Details

In the Linux kernel, the following vulnerability has been resolved:

accel/amdxdna: Fix an integer overflow in aie2queryctxstatusarray()

The unpublished smatch static checker reported a warning.

drivers/accel/amdxdna/aie2pci.c:904 aie2queryctxstatusarray() warn: potential user controlled sizeof overflow 'args->numelement * args->element_size' '1-u32max(user) * 1-u32max(user)'

Even this will not cause a real issue, it is better to put a reasonable limitation for elementsize and numelement. Add condition to make sure the input elementsize <= 4K and numelement <= 1K.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68731.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2f509fe6a42cda845890273fe759fb7ba9edad97
Fixed
359653edd5374fbba28f93043554dcc494aee85f
Fixed
9e16c8bf9aebf629344cfd4cd5e3dc7d8c3f7d82

Affected versions

v6.*
v6.17
v6.17-rc3
v6.17-rc4
v6.17-rc5
v6.17-rc6
v6.17-rc7
v6.18
v6.18-rc1
v6.18-rc2
v6.18-rc3
v6.18-rc4
v6.18-rc5
v6.18-rc6
v6.18-rc7
v6.18.1

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68731.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.18.0
Fixed
6.18.2

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68731.json"