Skip to main content

Linux Kernel CVE-2025-68265

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local NVMe ioctl access needs some privilege (PR:L) and exploitation depends on winning a controller-teardown race (AC:H); kernel UAF yields full memory-corruption impact (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.8 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 07:39 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:39 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 25, 2026 - 19:32 nvd
Patch available
Analysis Generated
Mar 25, 2026 - 11:22 vuln.today
CVE Published
Dec 16, 2025 - 15:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix admin request_queue lifetime

The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug:

BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted: [E]=UNSIGNED_MODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace: <TASK> dump_stack_lvl+0x4f/0x60 print_report+0xc4/0x620 ? _raw_spin_lock_irqsave+0x70/0xb0 ? _raw_read_unlock_irqrestore+0x30/0x30 ? blk_queue_enter+0x41c/0x4a0 kasan_report+0xab/0xe0 ? blk_queue_enter+0x41c/0x4a0 blk_queue_enter+0x41c/0x4a0 ? __irq_work_queue_local+0x75/0x1d0 ? blk_queue_start_drain+0x70/0x70 ? irq_work_queue+0x18/0x20 ? vprintk_emit.part.0+0x1cc/0x350 ? wake_up_klogd_work_func+0x60/0x60 blk_mq_alloc_request+0x2b7/0x6b0 ? __blk_mq_alloc_requests+0x1060/0x1060 ? __switch_to+0x5b7/0x1060 nvme_submit_user_cmd+0xa9/0x330 nvme_user_cmd.isra.0+0x240/0x3f0 ? force_sigsegv+0xe0/0xe0 ? nvme_user_cmd64+0x400/0x400 ? vfs_fileattr_set+0x9b0/0x9b0 ? cgroup_update_frozen_flag+0x24/0x1c0 ? cgroup_leave_frozen+0x204/0x330 ? nvme_ioctl+0x7c/0x2c0 blkdev_ioctl+0x1a8/0x4d0 ? blkdev_common_ioctl+0x1930/0x1930 ? fdget+0x54/0x380 __x64_sys_ioctl+0x129/0x190 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 </TASK>

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's NVMe driver arises from a use-after-free in admin request_queue lifetime management, where namespaces retain stale references to a controller's admin request_queue that can be dereferenced after the controller is torn down. Confirmed via a KASAN slab-use-after-free report in blk_queue_enter() triggered through an nvme ioctl (nvme_submit_user_cmd), the flaw affects hosts running NVMe storage and is fixed upstream by reordering the controller 'put' until after all references are released. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; exploitation requires local access and a race against controller teardown.

Technical ContextAI

The affected component is the Linux kernel NVMe subsystem (drivers/nvme/host), which manages NVMe controllers and their namespaces exposed as block devices (/dev/nvmeXnY). Each controller owns an 'admin' request_queue used to submit admin/passthrough commands; namespaces reference this queue. The root cause is a lifetime/ordering bug: the controller's reference 'put' on the admin request_queue occurred before all controller references (held via namespaces) were released, so a namespace could still reach blk_queue_enter() on an already-freed queue object. This is a classic use-after-free (CWE-416, though the input lists CWE as N/A) - the block layer's blk_mq_alloc_request path dereferences the freed queue during nvme_submit_user_cmd, as shown in the KASAN trace on kernel 6.13.2. The fix moves the controller 'put' to after all controller references are dropped, guaranteeing the admin queue stays live while any namespace can reach it.

Affected ProductsAI

The vulnerability is in the Linux kernel NVMe host driver; the KASAN report was observed on kernel 6.13.2 (6.13.2-ga1582f1a031e). Fixes are backported across multiple stable branches per the git.kernel.org stable commits (03b3bcd319b3, a505f0ba36ab, e7dac6817905, e8061d02b49c, ff037b5f47ee, 4896491c4972), indicating several affected/patched stable series. Distribution exposure is confirmed for Ubuntu via advisory USN-8094-4 (https://ubuntu.com/security/notices/USN-8094-4), and Siemens product security advisories SSA-019113 and SSA-082556 reference downstream products embedding affected kernels. No CPE strings were provided in the input, so exact vulnerable version ranges should be confirmed against the specific stable branch and distribution advisory in use.

RemediationAI

Apply the vendor kernel update: Ubuntu users should install the fixed kernel per USN-8094-4 (https://ubuntu.com/security/notices/USN-8094-4) and reboot; other distributions should pull the backport corresponding to the upstream stable commits (e.g., https://git.kernel.org/stable/c/03b3bcd319b3ab5182bc9aaa0421351572c78ac0 and the related stable commits) for their kernel series. Siemens deployments should follow SSA-019113 (https://cert-portal.siemens.com/productcert/html/ssa-019113.html) and SSA-082556 (https://cert-portal.siemens.com/productcert/html/ssa-082556.html). Where immediate patching is not possible, compensating controls include restricting access to NVMe device nodes by tightening permissions/ownership on /dev/nvme* and limiting who can issue nvme ioctls/passthrough commands (trade-off: may break monitoring or management tooling that relies on nvme-cli), and avoiding scripted or automated NVMe controller resets/hot-unplug operations on multi-user hosts to reduce the teardown race window (trade-off: constrains legitimate device management). These are mitigations only; the reference to the exact upstream fix is the reliable remedy.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed

Share

CVE-2025-68265 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy