CVE-2025-68784: Linux Kernel XFS Use-After-Free Flaw

CVE-2025-68784 Overview

CVE-2025-68784 is a use-after-free (UAF) vulnerability in the Linux kernel's XFS filesystem code, specifically within the extended attribute (xattr) repair routine. The flaw resides in how xchk_setup_xattr_buf allocates a new value buffer. Any reference to ab->value captured before this allocation can become a dangling pointer once the buffer is reallocated. The upstream fix moves the assignment to occur after the buffer setup, eliminating the stale reference. The issue was addressed via three stable kernel commits.

Critical Impact

Triggering the XFS xattr scrub/repair path on a crafted or corrupted filesystem could dereference a freed pointer, leading to kernel memory corruption or denial of service.

Affected Products

• Linux kernel (XFS filesystem subsystem)
• Distributions shipping vulnerable XFS scrub/repair code prior to the fix commits
• Systems using XFS online filesystem repair (xfs_scrub)

Discovery Timeline

• 2026-01-13 - CVE-2025-68784 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-68784

Vulnerability Analysis

The vulnerability lives in the XFS online repair code path responsible for fixing extended attributes. The xchk_setup_xattr_buf helper is responsible for ensuring a sufficiently large value buffer (ab->value) is available for xattr operations. When the existing buffer is too small, the function frees the old buffer and allocates a new one. The original code captured a pointer to ab->value before invoking this setup function. After reallocation, the captured pointer references freed memory. Subsequent use of the stale pointer constitutes a classic use-after-free condition [CWE-416] within kernel context. The exploitation surface is limited to local actors capable of invoking XFS scrub or mounting a crafted XFS image, but successful triggering corrupts kernel heap state.

Root Cause

The root cause is a stale pointer assignment ordering bug. The code cached ab->value before xchk_setup_xattr_buf could reallocate the buffer. The patch reorders the assignment so the local reference is taken only after buffer setup completes, ensuring the pointer is always valid for the lifetime of its use.

Attack Vector

Exploitation requires local access with the ability to trigger the XFS online repair functionality, typically through xfs_scrub on a mounted XFS filesystem. An attacker who can mount an attacker-controlled XFS image, or influence xattr layout to force buffer expansion during repair, can drive the kernel into the vulnerable code path. Network-based exploitation is not applicable.

No public proof-of-concept exploit is available. The fix is published across kernel stable branches in commits 1e2d3aa19c79, 5990fd756943, and d29ed9ff972a.

Detection Methods for CVE-2025-68784

Indicators of Compromise

• Unexpected kernel oops or panic messages referencing xchk_setup_xattr_buf or XFS xattr repair functions in dmesg and /var/log/messages.
• KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the XFS scrub code path on debug kernels.
• Repeated invocations of xfs_scrub by non-administrative users or unexpected processes.

Detection Strategies

• Compare installed kernel package versions against distribution security advisories that reference the three upstream commit hashes listed in the kernel.org references.
• Audit kernels for the presence of the corrected commit (d29ed9ff972afe17c215cab171761d7a15d7063f and backports) using git log against vendor source trees.
• Run vulnerability scanners with up-to-date OVAL or distribution-specific definitions covering CVE-2025-68784.

Monitoring Recommendations

• Forward kernel logs to a centralized logging or SIEM platform and alert on XFS subsystem crashes and KASAN traces.
• Monitor for unauthorized mounts of external XFS images, particularly from removable media or user-writable paths.
• Track invocations of xfs_scrub and correlate with the executing user identity and host context.

How to Mitigate CVE-2025-68784

Immediate Actions Required

• Apply the latest stable kernel update from your Linux distribution that includes the fix commits referenced on kernel.org.
• Reboot affected hosts after kernel updates to load the patched kernel image.
• Restrict the ability to mount untrusted XFS filesystems by non-root users via udev and mount policy controls.

Patch Information

The vulnerability is resolved upstream in the Linux kernel via the following commits, which move the ab->value assignment to occur after xchk_setup_xattr_buf completes:

• Kernel commit 1e2d3aa19c79
• Kernel commit 5990fd756943
• Kernel commit d29ed9ff972a

Consult your distribution's security tracker (Red Hat, SUSE, Debian, Ubuntu, Oracle) for backported package versions.

Workarounds

• Disable or restrict execution of xfs_scrub and online XFS repair operations until kernels are patched.
• Prohibit mounting of untrusted or attacker-supplied XFS images on production hosts.
• Limit local user access on multi-tenant systems where unprivileged users could trigger filesystem repair logic.

# Check current kernel version and verify patch status
uname -r

# Debian/Ubuntu: update kernel package
sudo apt update && sudo apt upgrade linux-image-$(uname -r | sed 's/-generic//')

# RHEL/CentOS/Rocky/Alma
sudo dnf update kernel

# Restrict xfs_scrub execution to root only
sudo chmod 750 /usr/sbin/xfs_scrub

# Reboot to activate the patched kernel
sudo reboot