Skip to main content

Linux Kernel CVE-2025-68212

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local unprivileged syscall access (AV:L/PR:L), no user interaction, and an uninitialized kernel pointer dereference giving potential memory disclosure and corruption (C/I/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:22 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs: Fix uninitialized 'offp' in statmount_string()

In statmount_string(), most flags assign an output offset pointer (offp) which is later updated with the string offset. However, the STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP cases directly set the struct fields instead of using offp. This leaves offp uninitialized, leading to a possible uninitialized dereference when *offp is updated.

Fix it by assigning offp for UIDMAP and GIDMAP as well, keeping the code path consistent.

AnalysisAI

Local privilege-level information disclosure and memory corruption in the Linux kernel's VFS statmount() implementation arises from an uninitialized output-offset pointer ('offp') in statmount_string(). When a caller requests the STATMOUNT_MNT_UIDMAP or STATMOUNT_MNT_GIDMAP fields, those code paths write directly to the struct fields and never assign 'offp', so a later dereference of the uninitialized pointer can leak kernel memory or corrupt state. The CVSS 3.1 vector (AV:L/PR:L) indicates a local, low-privileged attacker is required; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).

Technical ContextAI

The flaw is in the Linux kernel filesystem/mount subsystem, specifically the statmount(2) system call handler statmount_string() in fs/namespace.c. statmount() copies variable-length string attributes (mount root, mount point, filesystem type, and the newer UID/GID ID-map fields) into a caller-supplied buffer, recording each string's location via an output offset pointer 'offp'. Most attribute cases set offp before the shared code updates *offp with the computed string offset, but the STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP branches populated their struct fields directly and skipped the offp assignment, leaving it uninitialized. The root cause maps to the CWE-457 (Use of Uninitialized Variable) / CWE-824 (Access of Uninitialized Pointer) class; NVD lists CWE as N/A. Because statmount() is a relatively recent interface (mount statx family), only kernels new enough to implement STATMOUNT_MNT_UIDMAP/GIDMAP are affected.

Affected ProductsAI

The vulnerability affects the mainline and stable Linux kernel in versions that implement the statmount() STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP attributes (the mount ID-map reporting feature). No exact affected version range or CPE was supplied in the input, and NVD provided no CPE match; affected versions should be confirmed against the specific stable trees referenced by the fix commits at git.kernel.org (https://git.kernel.org/stable/c/0778ac7df5137d5041783fadfc201f8fd55a1d9b and https://git.kernel.org/stable/c/acfde9400e611c8d2668f1c70053c4a1d6ecfc36). Distribution kernels (RHEL, Ubuntu, Debian, SUSE, etc.) shipping the statmount UID/GID map feature inherit the issue until they backport the fix.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the stable-tree commits 0778ac7df5137d5041783fadfc201f8fd55a1d9b and acfde9400e611c8d2668f1c70053c4a1d6ecfc36 (https://git.kernel.org/stable/c/0778ac7df5137d5041783fadfc201f8fd55a1d9b, https://git.kernel.org/stable/c/acfde9400e611c8d2668f1c70053c4a1d6ecfc36), which assign offp for the UIDMAP and GIDMAP cases so the shared *offp update is well-defined. Operationally, upgrade to the distribution kernel package that incorporates this backport once your vendor publishes it, then reboot. No exact fixed release tag was provided in the input, so do not rely on an assumed version number; verify against your stable tree. If patching must be deferred, the practical compensating control is to limit local untrusted code execution and reduce exposure of the statmount() path - for example restrict access to multi-tenant/local shell accounts and containers, and where feasible constrain the statmount syscall via seccomp filters for untrusted workloads (trade-off: seccomp policies can break container runtimes or monitoring tools that legitimately call the newer mount-info syscalls, so test before enforcing).

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68212 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy