Skip to main content

Linux Kernel CVE-2025-68317

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local io_uring access needed (AV:L/PR:L); cross-context notification chaining is race-sensitive and hard to trigger reliably per the ambiguous syz reports, so AC:H rather than AC:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:09 vuln.today
CVE Published
Dec 16, 2025 - 16:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

io_uring/zctx: check chained notif contexts

Send zc only links ubuf_info for requests coming from the same context. There are some ambiguous syz reports, so let's check the assumption on notification completion.

AnalysisAI

Local privilege-context memory corruption in the Linux kernel's io_uring zero-copy send (zctx) path allows a local user to trigger unsafe handling of chained notification (ubuf_info) contexts. The flaw stems from send-zerocopy operations linking ubuf_info structures that may originate from a different io_uring context than assumed, and the fix adds a check enforcing that only same-context notifications are chained. No public exploit has been identified at time of analysis; EPSS is very low (0.16%, 6th percentile) and the issue is not on the CISA KEV list, but the CVSS base score of 7.8 reflects high confidentiality, integrity, and availability impact for a successful local trigger.

Technical ContextAI

io_uring is the Linux kernel's asynchronous I/O interface (introduced in 5.1) that lets user space submit batched operations via shared submission/completion ring buffers. This vulnerability lives in its zero-copy send feature (IORING_OP_SEND_ZC / sendmsg-zc), where the kernel avoids copying user payloads by pinning user pages and tracking their lifetime through a ubuf_info notification object. The bug is that the send-zc path could link a ubuf_info notification belonging to a chained request that came from a different io_uring context, violating the invariant that a notification completion is tied to its originating context. Ambiguous syzkaller (syz) fuzzing reports prompted the maintainers to add an explicit check on chained notification contexts. No CWE was assigned by NVD, but the class is best described as improper handling of object lifetime/ownership across contexts (a use-after-free / type-confusion style memory-safety defect around the notification object), with the vendor-supplied tag indicating Information Disclosure.

Affected ProductsAI

The affected product is the mainline and stable Linux kernel, specifically builds that include the io_uring zero-copy send (zctx/send-zc) subsystem. No CPE strings were provided in the intelligence set and NVD lists no explicit version ranges; affected versions must be inferred from the three stable-tree fix commits at git.kernel.org (aaafd17d3f4be2c15539359a5b4bfa00237f687f, ab3ea6eac5f45669b091309f592c4ea324003053, d664a3ce3a604231a0b144c152a3755d03b18b60), which indicate the fix was backported to multiple stable branches. Distributions shipping io_uring-enabled kernels (effectively all modern general-purpose distros) should be considered potentially affected until they ship a kernel including these commits; consult your distribution's security tracker for the exact patched package version.

RemediationAI

Upstream fix available (commit-based); a specific tagged release version was not provided in the input, so update to your distribution's kernel build that incorporates stable commits aaafd17d3f4be, ab3ea6eac5f4, and d664a3ce3a60 (see https://git.kernel.org/stable/c/aaafd17d3f4be2c15539359a5b4bfa00237f687f and the two companion commits). Apply the patched kernel through your distribution's normal update channel and reboot. Where immediate patching is not possible, the most effective compensating control is to restrict or disable io_uring for untrusted workloads: set the sysctl kernel.io_uring_disabled=2 to disable io_uring system-wide (trade-off: breaks applications that rely on io_uring, e.g. some high-performance servers/databases), or use a seccomp/BPF-LSM policy to block io_uring_setup for untrusted processes and containers. Additionally, limit local shell/code-execution access on multi-tenant hosts, since exploitation requires the ability to run local code that issues io_uring operations.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed

Share

CVE-2025-68317 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy