CVE-2025-68294: io_uring/net: ensure vectored buffer node import is tied to notification
In the Linux kernel, the following vulnerability has been resolved:
iouring/net: ensure vectored buffer node import is tied to notification
When support for vectored registered buffers was added, the import itself is using 'req' rather than the notification iokiocb, sr->notif. For non-vectored imports, sr->notif is correctly used. This is important as the lifetime of the two may be different. Use the correct iokiocb for the vectored buffer import.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68294?
CVE-2025-68294 has been designated as a high severity vulnerability due to its potential impact on the Linux kernel.
How do I fix CVE-2025-68294?
To fix CVE-2025-68294, you should update your Linux kernel to the latest stable version where the vulnerability has been resolved.
What systems are affected by CVE-2025-68294?
CVE-2025-68294 affects the Linux kernel, particularly systems utilizing io_uring with vectored registered buffers.
What is the impact of CVE-2025-68294?
The impact of CVE-2025-68294 may include improper handling of vectored buffer notifications, which could lead to undefined behavior.
When was CVE-2025-68294 disclosed?
CVE-2025-68294 was disclosed as a part of ongoing updates to the Linux kernel addressing security vulnerabilities.