CVE-2025-68814: io_uring: fix filename leak in __io_openat_prep()
In the Linux kernel, the following vulnerability has been resolved:
iouring: fix filename leak in ioopenatprep()
ioopenatprep() allocates a struct filename using getname(). However, for the condition of the file being installed in the fixed file table as well as having OCLOEXEC flag set, the function returns early. At that point, the request doesn't have REQFNEEDCLEANUP flag set. Due to this, the memory for the newly allocated struct filename is not cleaned up, causing a memory leak.
Fix this by setting the REQFNEEDCLEANUP for the request just after the successful getname() call, so that when the request is torn down, the filename will be cleaned up, along with other resources needing cleanup.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the memory leak by setting REQ_F_NEED_CLEANUP for the request just after the point mentioned in the vulnerability description, since the request at that time does not have the REQ_F_NEED_CLEANUP flag set.
Linux kernel io_uring REQ_F_NEED_CLEANUP = set for the request just after the condition point where the request lacks the flag
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68814?
CVE-2025-68814 has a moderate severity rating due to its impact on information leakage.
How do I fix CVE-2025-68814?
To fix CVE-2025-68814, update your Linux kernel to the latest stable version provided by your distribution.
What causes the CVE-2025-68814 vulnerability?
CVE-2025-68814 is caused by a filename leak in the __io_openat_prep() function within the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2025-68814?
CVE-2025-68814 affects multiple versions of the Linux kernel prior to the release of the patch.
Is CVE-2025-68814 exploitable in production environments?
Yes, CVE-2025-68814 could be exploited in production environments if systems are running affected versions of the Linux kernel.