CVE-2025-68791: Linux Kernel FUSE Resource Leak Flaw

CVE-2025-68791 Overview

A vulnerability has been identified in the Linux kernel's FUSE (Filesystem in Userspace) subsystem related to the io-uring interface. The flaw involves a missing copy_finish call during fuse-over-io-uring argument copies, which can result in a reference count leak of payload pages. This memory management issue could lead to resource exhaustion or system instability under certain conditions.

Critical Impact
Reference count leak in FUSE payload pages during io-uring argument copies can cause memory leaks and potential system degradation.

Affected Products

Linux Kernel (FUSE subsystem with io-uring support)
Systems utilizing fuse-over-io-uring functionality

Discovery Timeline

2026-01-13 - CVE CVE-2025-68791 published to NVD
2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68791

Vulnerability Analysis

This vulnerability exists within the Linux kernel's FUSE filesystem implementation, specifically in the code path that handles argument copying when FUSE operations are performed over the io-uring asynchronous I/O interface. The issue stems from an incomplete cleanup sequence where the copy_finish function is not properly invoked after certain argument copy operations.

When FUSE operations are processed through io-uring, payload data must be copied between userspace and kernel space. Each page involved in this transfer has an associated reference count that tracks its usage. The missing copy_finish call means that these reference counts are not properly decremented after the copy operation completes, leading to leaked references.

Root Cause

The root cause is a missing invocation of the copy_finish function in the fuse-over-io-uring argument copy code path. This function is responsible for finalizing the copy operation and properly releasing page references. Without this call, the reference counts on payload pages remain elevated, preventing proper memory reclamation by the kernel's memory management subsystem.

Attack Vector

The attack vector for this vulnerability is primarily local. An attacker with local access to a system running FUSE filesystems over io-uring could potentially trigger this condition repeatedly to cause memory resource exhaustion. While not directly exploitable for code execution, sustained exploitation could lead to denial of service conditions through memory depletion.

The vulnerability is triggered through normal FUSE operations when:

The system uses the fuse-over-io-uring interface
Argument copy operations are performed
The error cleanup path or normal completion path fails to call copy_finish

Detection Methods for CVE-2025-68791

Indicators of Compromise

Gradual memory consumption increase on systems running FUSE filesystems
Kernel memory leak warnings in system logs related to page allocation
Degraded system performance over time without clear cause
FUSE-related operations becoming slower or unresponsive

Detection Strategies

Monitor kernel memory statistics for unexplained growth in allocated pages
Review kernel logs for memory allocation warnings or FUSE subsystem errors
Track memory usage patterns on systems actively using FUSE with io-uring
Implement memory leak detection tools to identify unreleased page references

Monitoring Recommendations

Enable kernel memory debugging options to detect reference count anomalies
Set up alerts for abnormal memory consumption patterns on FUSE-enabled systems
Regularly audit FUSE mount points and io-uring usage in production environments
Monitor /proc/meminfo for unexpected changes in memory allocation statistics

How to Mitigate CVE-2025-68791

Immediate Actions Required

Update the Linux kernel to a patched version that includes the fix
Review systems for active use of fuse-over-io-uring functionality
Monitor affected systems for signs of memory degradation
Consider temporarily disabling io-uring for FUSE operations if patches cannot be immediately applied

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that copy_finish is properly called during FUSE argument copy operations, preventing the reference count leak.

Official kernel patches are available:

Workarounds

Disable io-uring support for FUSE filesystems if not critically required
Implement periodic system restarts to clear accumulated memory leaks on unpatched systems
Use traditional FUSE interfaces instead of the io-uring path until patches are applied
Monitor and set memory limits for processes interacting with FUSE filesystems

bash

# Check current kernel version for vulnerability assessment
uname -r

# Monitor memory usage for FUSE-related processes
cat /proc/meminfo | grep -E "(MemFree|Buffers|Cached|Slab)"

# List active FUSE mounts on the system
mount | grep fuse