Skip to main content

Linux Kernel CVE-2025-68805

HIGH
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local unprivileged FUSE mount access gives PR:L and AV:L; the terminate-before-commit race warrants AC:H, and a kernel UAF plausibly yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 07:13 vuln.today
v4 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:13 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:12 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 13, 2026 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix io-uring list corruption for terminated non-committed requests

When a request is terminated before it has been committed, the request is not removed from the queue's list. This leaves a dangling list entry that leads to list corruption and use-after-free issues.

Remove the request from the queue's list for terminated non-committed requests.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel FUSE subsystem's io-uring path allows an unprivileged local user to trigger list corruption and a resulting use-after-free. The flaw stems from a terminated-but-not-committed FUSE io-uring request never being unlinked from the queue's list, leaving a dangling entry that corrupts kernel memory. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; a fix has been merged upstream and shipped by distributions such as Ubuntu.

Technical ContextAI

FUSE (Filesystem in Userspace) lets unprivileged userspace processes implement filesystems, and the kernel's newer FUSE-over-io-uring transport queues in-flight requests on per-queue linked lists to service them via io_uring completion rings. The root cause is a lifecycle/list-management error (functionally CWE-416 Use-After-Free and CWE-460/CWE-825-style dangling-pointer handling; the feed lists CWE as N/A): when a request is terminated before it is committed, the code fails to remove it from the queue list, so the freed request object remains linked. Subsequent list traversal or insertion dereferences the stale entry, producing list corruption and use-after-free. The affected code is the FUSE io-uring request handling introduced in recent kernels; the fix (kernel.org stable commits 95c39eef7c2b and a6d1f1ace16d) adds the missing list removal for terminated non-committed requests.

Affected ProductsAI

The affected product is the Linux kernel, specifically the FUSE io-uring request-handling code; no explicit CPE string or precise vulnerable version range is provided in the input, though the feature is present only in kernels that support FUSE-over-io-uring. Fix commits are published at git.kernel.org (stable/c/95c39eef7c2b666026c69ab5b30471da94ea2874 and stable/c/a6d1f1ace16d0e777a85f84267160052d3499b6e). Distribution-specific affected packages and versions for Ubuntu are enumerated in Ubuntu advisory USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1), and a third-party summary is at VulDB (https://vuldb.com/?id.340644). Exact fixed kernel release tags are not stated in the provided data and should be confirmed against your distribution's changelog.

RemediationAI

Upstream fix available (commit); a released patched version tag is not independently confirmed in the provided data. Apply your distribution's updated kernel that incorporates commits 95c39eef7c2b and a6d1f1ace16d - Ubuntu users should install the kernel packages referenced in USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and reboot, and other distributions should pull the corresponding stable backport from git.kernel.org. If patching must be deferred, reduce exposure by restricting who can mount FUSE filesystems: mask or restrict the fusermount setuid helper and set the sysctl/administrative controls so only trusted users can create FUSE mounts, or disable the FUSE-over-io-uring path where it can be toggled - trade-off is that legitimate userspace-filesystem tools (e.g. sshfs, container overlay helpers) will lose functionality. In multi-tenant or container hosts, deny untrusted users the ability to mount FUSE and avoid granting the capabilities needed to reach this code path until the kernel is updated.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68805 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy