CVE-2025-68805: Linux Kernel Use-After-Free Vulnerability

CVE-2025-68805 Overview

A vulnerability has been discovered in the Linux kernel's FUSE (Filesystem in Userspace) subsystem related to io-uring request handling. When a request is terminated before it has been committed, the request is not properly removed from the queue's list. This leaves a dangling list entry that can lead to list corruption and use-after-free conditions, potentially compromising system stability and security.

Critical Impact

This vulnerability can result in list corruption and use-after-free issues in the Linux kernel, potentially allowing attackers to cause system instability, denial of service, or achieve privilege escalation through memory corruption.

Affected Products

• Linux kernel with FUSE and io-uring support enabled
• Systems utilizing FUSE filesystems with io-uring operations
• Linux distributions running vulnerable kernel versions

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-68805 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68805

Vulnerability Analysis

This vulnerability resides in the FUSE subsystem's handling of io-uring requests within the Linux kernel. The core issue stems from improper cleanup of request structures when a request is terminated before reaching its committed state.

Under normal operation, when a FUSE request completes its lifecycle, it should be properly removed from the associated queue's linked list. However, in the vulnerable code path, when a request is terminated prematurely (before being committed), the request structure remains on the queue's list even after the memory for that request may be freed or reused.

This creates a classic use-after-free scenario where the linked list continues to reference memory that is no longer valid. Subsequent operations on the queue may traverse this dangling pointer, leading to list corruption when the kernel attempts to read or write to the freed memory location.

Root Cause

The root cause of this vulnerability is the absence of proper list removal logic for terminated non-committed requests in the FUSE io-uring code path. When a request enters the terminated state without first being committed, the cleanup code fails to remove the request from the queue's list data structure. This oversight leaves a stale entry in the list that points to potentially freed memory.

Attack Vector

The attack vector for this vulnerability involves triggering the termination of FUSE io-uring requests before they reach the committed state. An attacker with local access could potentially:

1. Create conditions that cause io-uring requests to the FUSE filesystem to terminate early
2. Repeatedly trigger this condition to create multiple dangling list entries
3. Exploit the resulting memory corruption through carefully timed operations

The vulnerability requires local access and the ability to interact with FUSE filesystems using io-uring, limiting the attack surface to local privilege escalation scenarios.

Detection Methods for CVE-2025-68805

Indicators of Compromise

• Kernel log messages indicating list corruption in FUSE or io-uring subsystems
• Unexpected system crashes or kernel panics during FUSE filesystem operations
• Memory corruption warnings such as list_del corruption or use-after-free detected by KASAN
• Anomalous behavior during io-uring operations on FUSE-mounted filesystems

Detection Strategies

• Enable Kernel Address Sanitizer (KASAN) to detect use-after-free conditions at runtime
• Monitor kernel logs for list corruption errors related to FUSE subsystem
• Deploy kernel runtime integrity monitoring solutions to detect memory corruption
• Use SentinelOne's Singularity platform to monitor for kernel-level anomalies and exploitation attempts

Monitoring Recommendations

• Configure system logging to capture kernel warnings and errors related to FUSE and io-uring
• Implement alerting on kernel panic events, particularly those referencing memory corruption
• Monitor for unusual patterns of FUSE filesystem activity that could indicate exploitation attempts
• Enable kernel crash dump analysis for post-incident forensic investigation

How to Mitigate CVE-2025-68805

Immediate Actions Required

• Update to a patched Linux kernel version that includes the fix for this vulnerability
• If immediate patching is not possible, consider disabling io-uring for FUSE filesystems as a temporary measure
• Review and audit systems that utilize FUSE filesystems for signs of exploitation
• Monitor kernel logs for any indicators of list corruption or use-after-free conditions

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that terminated non-committed requests are properly removed from the queue's list, preventing the dangling list entry condition.

Patch commits are available in the stable kernel tree:

• Kernel Git Commit 95c39eef7c2b
• Kernel Git Commit a6d1f1ace16d

System administrators should apply these patches through their distribution's standard update mechanisms or by compiling a patched kernel from source.

Workarounds

• Disable io-uring support for FUSE filesystems if patching is not immediately feasible
• Limit local user access to systems running vulnerable kernel versions
• Consider using alternative filesystem mounting mechanisms that do not rely on the vulnerable FUSE io-uring code path
• Implement strict access controls on FUSE mount operations to reduce the attack surface

# Check current kernel version
uname -r

# Verify if FUSE module is loaded
lsmod | grep fuse

# Monitor kernel logs for corruption indicators
dmesg | grep -i "list.*corruption\|use-after-free\|fuse"