CVE-2025-68814

Vulnerability

Details

In the Linux kernel's io_uring subsystem, the function __io_openat_prep() allocates a struct filename via getname(). However, when the file is to be installed in the fixed file table and has the O_CLOEXEC flag set, the function returns early without setting the REQ_F_NEED_CLEANUP flag on the request. This omission means the allocated struct filename is never freed, causing a memory leak [1][2][3].

Exploitation and

Impact

An attacker who can trigger the affected code path (by submitting an IORING_OP_OPENAT request with the appropriate flags) could cause the kernel to leak memory. Repeated exploitation would lead to exhaustion of system memory, resulting in a denial of service (DoS) condition. The vulnerability does not require any special privileges beyond the ability to use io_uring, which is available to unprivileged users in many configurations.

Mitigation

The fix, which sets REQ_F_NEED_CLEANUP immediately after the successful getname() call, has been applied to the Linux kernel stable branches [1][2][3]. Users should update to the latest kernel version that includes the commit. No workaround is available, as the issue is in core kernel code. The CVE is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.