CVE-2025-68219

What it actually does

Memory leak in smb3_fs_context_parse_param error path where ctx->source and fc->source allocations are not freed before jumping to cifs_parse_mount_err, allowing repeated Opt_source handling to exhaust kernel memory.

Why it matters to the business

Long-running Linux systems performing CIFS mounts may experience gradual memory exhaustion, reduced performance, or out-of-memory conditions, especially in container or CI environments with frequent mount attempts; low EPSS and no KEV status indicate limited immediate operational urgency despite 315 days since publication.

How an attack unfolds

An attacker with local or mount-triggering access could repeatedly invoke CIFS mount operations that allocate source strings then hit an error path before cleanup; the original syzbot-reported sequence involves allocation followed by early return without freeing, though no threat actors or ransomware campaigns are associated and EPSS remains flat at ~0.002.

How to fix it

Upgrade affected Linux kernel to commit 7627864dc3121f39e220f5253a227edf472de59e or later; for Chainguard packages update gitlab-runner, gitlab-docker-machine and related helper images to 17.6.1-r0 or newer.

How to confirm the fix worked

Verify package versions match fixed releases, review kernel changelog for the cited commit, and confirm absence of the described leak sequence in smb3_fs_context_parse_param error handling.

Typical attack path

1. Trigger CIFS mount with Opt_source option
2. Allocate ctx->source via smb3_fs_context_fullpath
3. Allocate fc->source via kstrdup
4. Induce subsequent error to reach cifs_parse_mount_err without source cleanup

How to detect it

Review kernel logs and memory accounting for repeated CIFS mount failures; correlate with process activity invoking mount or fsconfig on CIFS filesystems, though no specific post-exploitation artifacts are available.

What your security team should do

• Prioritize kernel and dependent package updates on all CIFS-using systems
• Monitor memory usage trends during CIFS mount operations
• Audit mount configurations to reduce unnecessary error-prone attempts