vulnerability

Ubuntu: (Multiple Advisories) (CVE-2025-68198): Linux kernel vulnerabilities

Severity
5
CVSS
(AV:L/AC:L/Au:S/C:N/I:N/A:C)
Published
Feb 12, 2026
Added
Feb 13, 2026
Modified
Apr 3, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

crash: fix crashkernel resource shrink

When crashkernel is configured with a high reservation, shrinking its
value below the low crashkernel reservation causes two issues:

1. Invalid crashkernel resource objects
2. Kernel crash if crashkernel shrinking is done twice

For example, with crashkernel=200M,high, the kernel reserves 200MB of high
memory and some default low memory (say 256MB). The reservation appears
as:

cat /proc/iomem | grep -i crash
af000000-beffffff : Crash kernel
433000000-43f7fffff : Crash kernel

If crashkernel is then shrunk to 50MB (echo 52428800 >
/sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved:
af000000-beffffff : Crash kernel

Instead, it should show 50MB:
af000000-b21fffff : Crash kernel

Further shrinking crashkernel to 40MB causes a kernel crash with the
following trace (x86):

BUG: kernel NULL pointer dereference, address: 0000000000000038
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
<snip...>
Call Trace: <TASK>
? __die_body.cold+0x19/0x27
? page_fault_oops+0x15a/0x2f0
? search_module_extables+0x19/0x60
? search_bpf_extables+0x5f/0x80
? exc_page_fault+0x7e/0x180
? asm_exc_page_fault+0x26/0x30
? __release_resource+0xd/0xb0
release_resource+0x26/0x40
__crash_shrink_memory+0xe5/0x110
crash_shrink_memory+0x12a/0x190
kexec_crash_size_store+0x41/0x80
kernfs_fop_write_iter+0x141/0x1f0
vfs_write+0x294/0x460
ksys_write+0x6d/0xf0
<snip...>

This happens because __crash_shrink_memory()/kernel/crash_core.c
incorrectly updates the crashk_res resource object even when
crashk_low_res should be updated.

Fix this by ensuring the correct crashkernel resource object is updated
when shrinking crashkernel memory.

Solutions

ubuntu-upgrade-linux-image-6-17-0-1006-realtimeubuntu-upgrade-linux-image-6-17-0-1007-awsubuntu-upgrade-linux-image-6-17-0-1007-aws-64kubuntu-upgrade-linux-image-6-17-0-1007-gcpubuntu-upgrade-linux-image-6-17-0-1007-gcp-64kubuntu-upgrade-linux-image-6-17-0-1007-oracleubuntu-upgrade-linux-image-6-17-0-1007-oracle-64kubuntu-upgrade-linux-image-6-17-0-1008-azureubuntu-upgrade-linux-image-6-17-0-1008-raspiubuntu-upgrade-linux-image-6-17-0-1011-oemubuntu-upgrade-linux-image-6-17-0-14-genericubuntu-upgrade-linux-image-6-17-0-14-generic-64kubuntu-upgrade-linux-image-6-8-0-1035-gkeopubuntu-upgrade-linux-image-6-8-0-1047-oracleubuntu-upgrade-linux-image-6-8-0-1047-oracle-64kubuntu-upgrade-linux-image-6-8-0-1048-gkeubuntu-upgrade-linux-image-6-8-0-1048-gke-64kubuntu-upgrade-linux-image-6-8-0-1049-ibmubuntu-upgrade-linux-image-6-8-0-1049-nvidiaubuntu-upgrade-linux-image-6-8-0-1049-nvidia-64kubuntu-upgrade-linux-image-6-8-0-1049-nvidia-lowlatencyubuntu-upgrade-linux-image-6-8-0-1049-nvidia-lowlatency-64kubuntu-upgrade-linux-image-6-8-0-1050-awsubuntu-upgrade-linux-image-6-8-0-1050-aws-64kubuntu-upgrade-linux-image-6-8-0-1050-aws-fipsubuntu-upgrade-linux-image-6-8-0-1050-raspiubuntu-upgrade-linux-image-6-8-0-1051-azureubuntu-upgrade-linux-image-6-8-0-1052-gcpubuntu-upgrade-linux-image-6-8-0-1052-gcp-64kubuntu-upgrade-linux-image-6-8-0-1052-gcp-fipsubuntu-upgrade-linux-image-6-8-0-106-fipsubuntu-upgrade-linux-image-6-8-0-106-genericubuntu-upgrade-linux-image-6-8-0-106-generic-64kubuntu-upgrade-linux-image-6-8-0-106-lowlatencyubuntu-upgrade-linux-image-6-8-0-106-lowlatency-64kubuntu-upgrade-linux-image-6-8-0-2040-raspi-realtimeubuntu-upgrade-linux-image-6-8-1-1045-realtimeubuntu-upgrade-linux-image-awsubuntu-upgrade-linux-image-aws-6-17ubuntu-upgrade-linux-image-aws-6-8ubuntu-upgrade-linux-image-aws-64kubuntu-upgrade-linux-image-aws-64k-6-17ubuntu-upgrade-linux-image-aws-64k-6-8ubuntu-upgrade-linux-image-aws-64k-lts-24-04ubuntu-upgrade-linux-image-aws-fipsubuntu-upgrade-linux-image-aws-fips-6-8ubuntu-upgrade-linux-image-aws-lts-24-04ubuntu-upgrade-linux-image-azureubuntu-upgrade-linux-image-azure-6-17ubuntu-upgrade-linux-image-azure-6-8ubuntu-upgrade-linux-image-azure-lts-24-04ubuntu-upgrade-linux-image-fipsubuntu-upgrade-linux-image-fips-6-8ubuntu-upgrade-linux-image-gcpubuntu-upgrade-linux-image-gcp-6-17ubuntu-upgrade-linux-image-gcp-6-8ubuntu-upgrade-linux-image-gcp-64kubuntu-upgrade-linux-image-gcp-64k-6-17ubuntu-upgrade-linux-image-gcp-64k-6-8ubuntu-upgrade-linux-image-gcp-64k-lts-24-04ubuntu-upgrade-linux-image-gcp-fipsubuntu-upgrade-linux-image-gcp-fips-6-8ubuntu-upgrade-linux-image-gcp-lts-24-04ubuntu-upgrade-linux-image-genericubuntu-upgrade-linux-image-generic-6-17ubuntu-upgrade-linux-image-generic-6-8ubuntu-upgrade-linux-image-generic-64kubuntu-upgrade-linux-image-generic-64k-6-17ubuntu-upgrade-linux-image-generic-64k-6-8ubuntu-upgrade-linux-image-generic-64k-hwe-22-04ubuntu-upgrade-linux-image-generic-hwe-22-04ubuntu-upgrade-linux-image-generic-lpaeubuntu-upgrade-linux-image-gkeubuntu-upgrade-linux-image-gke-6-8ubuntu-upgrade-linux-image-gke-64kubuntu-upgrade-linux-image-gke-64k-6-8ubuntu-upgrade-linux-image-gkeopubuntu-upgrade-linux-image-gkeop-6-8ubuntu-upgrade-linux-image-ibmubuntu-upgrade-linux-image-ibm-6-8ubuntu-upgrade-linux-image-ibm-classicubuntu-upgrade-linux-image-ibm-lts-24-04ubuntu-upgrade-linux-image-intel-iot-realtimeubuntu-upgrade-linux-image-intel-iotgubuntu-upgrade-linux-image-kvmubuntu-upgrade-linux-image-lowlatencyubuntu-upgrade-linux-image-lowlatency-6-8ubuntu-upgrade-linux-image-lowlatency-64kubuntu-upgrade-linux-image-lowlatency-64k-6-8ubuntu-upgrade-linux-image-lowlatency-64k-hwe-22-04ubuntu-upgrade-linux-image-lowlatency-hwe-22-04ubuntu-upgrade-linux-image-nvidiaubuntu-upgrade-linux-image-nvidia-6-8ubuntu-upgrade-linux-image-nvidia-64kubuntu-upgrade-linux-image-nvidia-64k-6-8ubuntu-upgrade-linux-image-nvidia-64k-hwe-22-04ubuntu-upgrade-linux-image-nvidia-hwe-22-04ubuntu-upgrade-linux-image-nvidia-lowlatencyubuntu-upgrade-linux-image-nvidia-lowlatency-6-8ubuntu-upgrade-linux-image-nvidia-lowlatency-64kubuntu-upgrade-linux-image-nvidia-lowlatency-64k-6-8ubuntu-upgrade-linux-image-oem-22-04ubuntu-upgrade-linux-image-oem-22-04aubuntu-upgrade-linux-image-oem-22-04bubuntu-upgrade-linux-image-oem-22-04cubuntu-upgrade-linux-image-oem-22-04dubuntu-upgrade-linux-image-oem-6-17ubuntu-upgrade-linux-image-oracleubuntu-upgrade-linux-image-oracle-6-17ubuntu-upgrade-linux-image-oracle-6-8ubuntu-upgrade-linux-image-oracle-64kubuntu-upgrade-linux-image-oracle-64k-6-17ubuntu-upgrade-linux-image-oracle-64k-6-8ubuntu-upgrade-linux-image-oracle-64k-lts-24-04ubuntu-upgrade-linux-image-oracle-lts-24-04ubuntu-upgrade-linux-image-raspiubuntu-upgrade-linux-image-raspi-6-17ubuntu-upgrade-linux-image-raspi-6-8ubuntu-upgrade-linux-image-raspi-realtimeubuntu-upgrade-linux-image-raspi-realtime-6-8ubuntu-upgrade-linux-image-realtimeubuntu-upgrade-linux-image-realtime-6-17ubuntu-upgrade-linux-image-realtime-6-8-1ubuntu-upgrade-linux-image-realtime-hwe-22-04ubuntu-upgrade-linux-image-virtualubuntu-upgrade-linux-image-virtual-6-17ubuntu-upgrade-linux-image-virtual-6-8ubuntu-upgrade-linux-image-virtual-hwe-22-04

References

    Title
    NEW

    Explore Exposure Command

    Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.