CVE-2025-68791: Linux Kernel FUSE Resource Leak Flaw

CVE-2025-68791 Overview

A vulnerability has been identified in the Linux kernel's FUSE (Filesystem in Userspace) subsystem related to the io-uring interface. The flaw involves a missing copy_finish call during fuse-over-io-uring argument copies, which can result in a reference count leak of payload pages. This memory management issue could lead to resource exhaustion or system instability under certain conditions.

Critical Impact

Reference count leak in FUSE payload pages during io-uring argument copies can cause memory leaks and potential system degradation.

Affected Products

• Linux Kernel (FUSE subsystem with io-uring support)
• Systems utilizing fuse-over-io-uring functionality

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-68791 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68791

Vulnerability Analysis

This vulnerability exists within the Linux kernel's FUSE filesystem implementation, specifically in the code path that handles argument copying when FUSE operations are performed over the io-uring asynchronous I/O interface. The issue stems from an incomplete cleanup sequence where the copy_finish function is not properly invoked after certain argument copy operations.

When FUSE operations are processed through io-uring, payload data must be copied between userspace and kernel space. Each page involved in this transfer has an associated reference count that tracks its usage. The missing copy_finish call means that these reference counts are not properly decremented after the copy operation completes, leading to leaked references.

Root Cause

The root cause is a missing invocation of the copy_finish function in the fuse-over-io-uring argument copy code path. This function is responsible for finalizing the copy operation and properly releasing page references. Without this call, the reference counts on payload pages remain elevated, preventing proper memory reclamation by the kernel's memory management subsystem.

Attack Vector

The attack vector for this vulnerability is primarily local. An attacker with local access to a system running FUSE filesystems over io-uring could potentially trigger this condition repeatedly to cause memory resource exhaustion. While not directly exploitable for code execution, sustained exploitation could lead to denial of service conditions through memory depletion.

The vulnerability is triggered through normal FUSE operations when:

1. The system uses the fuse-over-io-uring interface
2. Argument copy operations are performed
3. The error cleanup path or normal completion path fails to call copy_finish

Detection Methods for CVE-2025-68791

Indicators of Compromise

• Gradual memory consumption increase on systems running FUSE filesystems
• Kernel memory leak warnings in system logs related to page allocation
• Degraded system performance over time without clear cause
• FUSE-related operations becoming slower or unresponsive

Detection Strategies

• Monitor kernel memory statistics for unexplained growth in allocated pages
• Review kernel logs for memory allocation warnings or FUSE subsystem errors
• Track memory usage patterns on systems actively using FUSE with io-uring
• Implement memory leak detection tools to identify unreleased page references

Monitoring Recommendations

• Enable kernel memory debugging options to detect reference count anomalies
• Set up alerts for abnormal memory consumption patterns on FUSE-enabled systems
• Regularly audit FUSE mount points and io-uring usage in production environments
• Monitor /proc/meminfo for unexpected changes in memory allocation statistics

How to Mitigate CVE-2025-68791

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the fix
• Review systems for active use of fuse-over-io-uring functionality
• Monitor affected systems for signs of memory degradation
• Consider temporarily disabling io-uring for FUSE operations if patches cannot be immediately applied

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that copy_finish is properly called during FUSE argument copy operations, preventing the reference count leak.

Official kernel patches are available:

• Kernel Patch Commit 6e0d7f7f
• Kernel Patch Commit b7993886

Workarounds

• Disable io-uring support for FUSE filesystems if not critically required
• Implement periodic system restarts to clear accumulated memory leaks on unpatched systems
• Use traditional FUSE interfaces instead of the io-uring path until patches are applied
• Monitor and set memory limits for processes interacting with FUSE filesystems

# Check current kernel version for vulnerability assessment
uname -r

# Monitor memory usage for FUSE-related processes
cat /proc/meminfo | grep -E "(MemFree|Buffers|Cached|Slab)"

# List active FUSE mounts on the system
mount | grep fuse