CVE-2025-68814

What it actually does

Memory leak of struct filename objects allocated via getname() in __io_openat_prep() when a request installs a file into the fixed file table with O_CLOEXEC; the REQ_F_NEED_CLEANUP flag is never set, so the filename is not freed on request teardown.

Why it matters to the business

Repeated triggering on Linux systems using io_uring can gradually exhaust kernel memory, leading to performance degradation or denial of service; widespread kernel prevalence increases exposure but low exploitability and no known campaigns limit immediate operational risk.

How an attack unfolds

An attacker triggers the vulnerable early-return path in __io_openat_prep() by submitting io_uring open requests that target the fixed file table while setting O_CLOEXEC, causing repeated allocations without cleanup and eventual memory exhaustion.

How to fix it

Apply the upstream fix by updating the Linux kernel to a version containing commit 2420ef01b2e836fbc05a0a8c73a1016504eb0458 or later; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 2420ef01b2e836fbc05a0a8c73a1016504eb0458 or a backport; confirm no early return occurs without REQ_F_NEED_CLEANUP by code review or memory-leak testing under the described io_uring conditions.

Typical attack path

1. Submit io_uring SQE for file open targeting fixed file table
2. Set O_CLOEXEC flag on the open request
3. Force early return before REQ_F_NEED_CLEANUP is applied
4. Repeat to accumulate leaked filename structures
5. Observe kernel memory growth until resource exhaustion

How to detect it

Review kernel memory statistics and io_uring request traces for repeated open operations into fixed file tables; correlate with process activity that uses io_uring SQEs carrying O_CLOEXEC to identify potential leak sources.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all production systems within standard change windows
• Monitor io_uring usage and kernel memory metrics for anomalous growth until patched
• Restrict untrusted code from using io_uring fixed file tables where feasible