CVE-2025-68348

What it actually does

Memory leak occurs in __blkdev_issue_zero_pages when BLKDEV_ZERO_KILLABLE is set and a fatal signal is pending: bio_alloc() happens before the signal check, so the loop exits without freeing or chaining the allocated bio.

Why it matters to the business

Repeated triggering can gradually exhaust kernel memory on Linux systems that perform block-device zeroing operations, leading to degraded performance, instability, or crashes over time; the issue has low exploitation probability and is not known to be used in ransomware.

How an attack unfolds

An attacker with local access or the ability to trigger block zero operations under conditions where a fatal signal can be made pending causes the kernel to leak bio structures without recovery; the flaw was present in the stable Linux kernel tree prior to the referenced commit and requires no special privileges beyond those needed to initiate the affected I/O path.

How to fix it

Update the Linux kernel to the commit 453e4b0c84d0db1454ff0adf655d91179e6fca3a or later; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 453e4b0c84d0db1454ff0adf655d91179e6fca3a; recompile with the fix and verify that signal-pending zero-page operations no longer leak memory via slab or kmemleak checks.

Typical attack path

1. Obtain local execution or trigger block-device zeroing operations
2. Arrange for a fatal signal to be pending at the time the zero-pages function runs
3. Cause repeated allocation of bios that are never freed or chained
4. Accumulate leaked memory until system resources are exhausted

How to detect it

Review kernel memory statistics and slab allocator usage for unexpected growth in bio-related objects during block zero operations; examine system logs for repeated fatal signal handling around block I/O paths.

What your security team should do

• Prioritize kernel updates on all Linux hosts that use block-device zeroing paths
• Monitor memory usage trends on production systems until patches are applied
• Include the fixed commit in automated kernel build and deployment pipelines