Skip to main content

Linux Kernel CVE-2025-68294

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local low-priv access to io_uring (AV:L/PR:L); the lifetime mismatch is a race requiring specific vectored zero-copy usage, so AC:H; kernel-context corruption gives full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.6 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:13 vuln.today
CVE Published
Dec 16, 2025 - 16:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: ensure vectored buffer node import is tied to notification

When support for vectored registered buffers was added, the import itself is using 'req' rather than the notification io_kiocb, sr->notif. For non-vectored imports, sr->notif is correctly used. This is important as the lifetime of the two may be different. Use the correct io_kiocb for the vectored buffer import.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's io_uring networking subsystem stems from vectored registered buffer imports being tied to the wrong io_kiocb (the request 'req' instead of the notification 'sr->notif'), creating an object-lifetime mismatch. Local low-privileged users on affected kernels can trigger use-after-free-style conditions leading to information disclosure or code execution in kernel context. No public exploit identified at time of analysis, and EPSS is low (0.16%).

Technical ContextAI

io_uring is the Linux kernel's high-performance asynchronous I/O interface, and its net path supports zero-copy send operations using pre-registered (fixed) buffers. When a send is performed with registered buffers, the buffer must be imported against the io_kiocb whose lifetime governs the underlying resource. For zero-copy sends, a separate notification request (sr->notif) is created whose lifetime may outlive the primary request, which is why non-vectored imports correctly bind to sr->notif. The bug is that the vectored-import path bound the buffer node to 'req' instead of 'sr->notif', so the buffer node's lifetime is tracked against the wrong object - the classic root cause is an incorrect object lifetime / use-after-free class (CWE-416), even though the NVD CWE is listed as N/A. When the request completes before the notification, the buffer node can be freed while still referenced, yielding memory corruption.

Affected ProductsAI

The affected product is the mainline Linux kernel, specifically the io_uring/net vectored registered-buffer send path introduced when support for vectored registered buffers was added; kernels containing that feature prior to the fix are vulnerable. No CPE strings were provided in the input, so precise version ranges are not enumerated by NVD here; the authoritative fix references are the kernel.org stable commits https://git.kernel.org/stable/c/14459281e027f23b70885c1cc1032a71c0efd8d7 and https://git.kernel.org/stable/c/f6041803a831266a2a5a5b5af66f7de0845bcbf3. Distribution-specific affected builds should be confirmed against each vendor's kernel changelog.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update containing commits f6041803a831266a2a5a5b5af66f7de0845bcbf3 and 14459281e027f23b70885c1cc1032a71c0efd8d7 (https://git.kernel.org/stable/c/f6041803a831266a2a5a5b5af66f7de0845bcbf3, https://git.kernel.org/stable/c/14459281e027f23b70885c1cc1032a71c0efd8d7), pulling the corresponding stable release from your distribution once published. If patching cannot be done immediately, the most effective compensating control is to restrict or disable io_uring: set the sysctl kernel.io_uring_disabled=2 to block io_uring_setup(2) system-wide (trade-off: breaks any application relying on io_uring), or restrict it to a privileged group via kernel.io_uring_disabled=1. Alternatively, constrain untrusted local users and container/sandbox profiles (e.g., seccomp) to forbid the io_uring_setup and related syscalls, which prevents reaching the vulnerable send path at the cost of losing io_uring performance for those workloads.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68294 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy