CVE-2025-68351

What it actually does

Refcount leak in exfat_find when exfat_get_dentry_set succeeds without subsequent exfat_put_dentry_set, leaving buffer head references unbalanced and enabling resource exhaustion or memory corruption in the exFAT driver.

Why it matters to the business

Systems using exFAT filesystems may experience kernel instability, crashes, or denial of service, increasing downtime and operational risk especially on servers or devices handling removable media; urgency is moderate given low exploitability and lack of known campaigns.

How an attack unfolds

An attacker with local access crafts or mounts a malicious exFAT volume and triggers repeated calls to exfat_find (via directory operations) to accumulate leaked references, eventually causing memory pressure or use-after-free conditions in the kernel.

How to fix it

Upgrade the Linux kernel to version 6.12.68 or later, or apply the commit fc9ce762525e73438d31b613f18bca92a4d3d578. For Chainguard packages, update logstash-jre-bcfips and related variants to 8.17.4-r0. Reboot systems after kernel updates and verify exFAT functionality.

How to confirm the fix worked

Confirm the running kernel version is at least 6.12.68; inspect the exfat_find function in the source to verify the relocated checks and presence of balanced exfat_put_dentry_set calls after every exfat_get_dentry_set success path.

Typical attack path

1. Obtain local user access on a Linux system with exFAT support enabled
2. Prepare a crafted exFAT filesystem image or USB device
3. Mount the image and perform directory/file enumeration operations that invoke exfat_find
4. Repeat operations to trigger the missing put_dentry_set path and accumulate refcount leaks
5. Trigger kernel memory pressure or specific access patterns to convert the leak into a crash or corruption

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for repeated exfat-related warnings or buffer-head reference errors around mount and directory operations; correlate with unusual USB or loopback device activity; no public exploitation artifacts are known.

What your security team should do

• Apply kernel updates to fixed versions immediately on all affected systems
• Disable exFAT support (via module blacklist or CONFIG_EXFAT_FS=n) if not required
• Monitor for unusual exFAT mount or directory operation patterns in system logs
• Test patched kernels in staging environments before production rollout