Skip to main content

Linux Kernel CVE-2025-68810

HIGH
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local KVM-ioctl access (AV:L, PR:L) with a simple deterministic trigger (AC:L); the UAF write threatens kernel integrity and host availability with potential info exposure, so C/I/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 07:08 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:07 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 13, 2026 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot

Reject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was initially created with a guest_memfd binding, as KVM doesn't support toggling KVM_MEM_GUEST_MEMFD on existing memslots. KVM prevents enabling KVM_MEM_GUEST_MEMFD, but doesn't prevent clearing the flag.

Failure to reject the new memslot results in a use-after-free due to KVM not unbinding from the guest_memfd instance. Unbinding on a FLAGS_ONLY change is easy enough, and can/will be done as a hardening measure (in anticipation of KVM supporting dirty logging on guest_memfd at some point), but fixing the use-after-free would only address the immediate symptom.

============== BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x362/0x400 [kvm] Write of size 8 at addr ffff8881111ae908 by task repro/745

CPU: 7 UID: 1000 PID: 745 Comm: repro Not tainted 6.18.0-rc6-115d5de2eef3-next-kasan #3 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x51/0x60 print_report+0xcb/0x5c0 kasan_report+0xb4/0xe0 kvm_gmem_release+0x362/0x400 [kvm] __fput+0x2fa/0x9d0 task_work_run+0x12c/0x200 do_exit+0x6ae/0x2100 do_group_exit+0xa8/0x230 __x64_sys_exit_group+0x3a/0x50 x64_sys_call+0x737/0x740 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f581f2eac31 </TASK>

Allocated by task 745 on cpu 6 at 9.746971s: kasan_save_stack+0x20/0x40 kasan_save_track+0x13/0x50 __kasan_kmalloc+0x77/0x90 kvm_set_memory_region.part.0+0x652/0x1110 [kvm] kvm_vm_ioctl+0x14b0/0x3290 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Freed by task 745 on cpu 6 at 9.747467s: kasan_save_stack+0x20/0x40 kasan_save_track+0x13/0x50 __kasan_save_free_info+0x37/0x50 __kasan_slab_free+0x3b/0x60 kfree+0xf5/0x440 kvm_set_memslot+0x3c2/0x1160 [kvm] kvm_set_memory_region.part.0+0x86a/0x1110 [kvm] kvm_vm_ioctl+0x14b0/0x3290 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's KVM subsystem allows a user with VM control (e.g. a QEMU/hypervisor process) to trigger a use-after-free by clearing the KVM_MEM_GUEST_MEMFD flag on a memslot that was created with a guest_memfd binding. KVM blocks enabling the flag on an existing memslot but never blocked disabling it, leaving the guest_memfd instance bound to freed memory that is later written during kvm_gmem_release. The flaw carries a CVSS of 7.8 and has a vendor-released fix; it is not in CISA KEV and no public exploit has been identified at time of analysis, with an EPSS of 0.02%.

Technical ContextAI

The bug lives in KVM (Kernel-based Virtual Machine), the Linux hypervisor infrastructure exposed through /dev/kvm ioctls. guest_memfd (KVM_MEM_GUEST_MEMFD) is a relatively new mechanism that backs guest memory with an anonymous, hypervisor-owned file descriptor rather than ordinary userspace mappings, primarily to support confidential-computing / private guest memory. When a memslot is created via KVM_SET_USER_MEMORY_REGION2 with the guest_memfd flag, KVM binds the memslot to that gmem instance. The root cause is a missing state-transition check: KVM correctly rejects turning the flag ON for an existing slot but failed to reject turning it OFF during a FLAGS_ONLY update, so the old memslot (and its gmem binding) is kfree'd without unbinding. The stale gmem reference is later dereferenced in kvm_gmem_release() when the file is closed, producing a slab-use-after-free (KASAN write-of-size-8). Although CWE is listed as N/A, this is a classic CWE-416 (Use After Free) arising from an incomplete invariant on an object lifecycle.

Affected ProductsAI

The Linux kernel's KVM module is affected on builds that support guest_memfd (KVM_MEM_GUEST_MEMFD), a feature present in recent mainline kernels; the KASAN reproducer was captured on 6.18.0-rc6. No CPE strings were provided in the input, so an exact affected-version range cannot be enumerated from this data. Fixes were committed to stable trees per the kernel.org stable commits (89dbbe6ff323fc34659621a577fe0af913f47386, 9935df5333aa503a18de5071f53762b65c783c4c, cb51bef465d8ec60a968507330e01020e35dc127). Ubuntu has published security notice USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) covering its kernel packages, and VulDB tracks the issue at https://vuldb.com/?id.340648. Distribution-specific fixed package versions should be taken from each vendor's advisory.

RemediationAI

Patch available per vendor advisory: apply the fixed kernel from your distribution. The upstream fix rejects clearing KVM_MEM_GUEST_MEMFD on an existing memslot and is carried in the stable commits 89dbbe6ff323fc34659621a577fe0af913f47386, 9935df5333aa503a18de5071f53762b65c783c4c, and cb51bef465d8ec60a968507330e01020e35dc127. Ubuntu users should upgrade to the kernel versions listed in USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and reboot; other distributions should apply their equivalent errata (cross-reference https://vuldb.com/?id.340648). If immediate patching is not possible on a virtualization host, the meaningful compensating control is to restrict who can reach the KVM API: ensure only trusted hypervisor processes hold access to /dev/kvm (tighten group/permissions), avoid granting untrusted or low-trust tenants direct KVM ioctl access, and where guest_memfd/confidential-VM features are not needed, keep them out of the guest configuration - the trade-off is that these controls reduce exposure but do not remove the code path, and locking down /dev/kvm can break legitimate local virtualization tooling. Because exploitation requires an already-privileged VM-control context, hardening the hypervisor process boundary is the most effective interim measure.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.105 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.124 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.90 Affected

Share

CVE-2025-68810 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy