Cloudanix VulnDB

CVE-2025-68821

None

CVSS

—

EPSS

0.2%

Published

Jan 13, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can cause the system to freeze when reading files through certain virtual filesystems under memory pressure.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in FUSE allows inode eviction from dcache during inflight readahead, causing deadlock when reclaim attempts to truncate locked folios in fuse_evict_inode while readahead holds the folio lock.

Why it matters to the business

Systems using FUSE filesystems may experience unrecoverable hangs during memory pressure combined with file readahead, leading to service disruption and requiring manual intervention or reboot.

How an attack unfolds

An attacker with local access triggers readahead on a FUSE-mounted file while the system is under memory pressure; the server-side reclaim then attempts to evict the inode, blocking indefinitely on the held folio lock.

How to fix it

Upgrade Linux kernel to 5.15.198 or later commit cbbf3f1bb9f834bb2acbb61ddca74363456e19cd; for Apptainer update to 1.4.5 or newer.

How to confirm the fix worked

Confirm kernel version contains the fix commit; reproduce the deadlock scenario under memory pressure with FUSE readahead to verify absence of hang.

Typical attack path

  1. Mount a FUSE filesystem that does not implement open
  2. Perform read operations that trigger readahead on the file
  3. Induce memory pressure to activate slab shrinkers and dentry pruning
  4. Force inode eviction while readahead folio remains locked

How to detect it

Search kernel logs for hung task traces containing folio_wait_bit_common, truncate_inode_pages_range, fuse_evict_inode, and shrink_dentry_list; look for FUSE mounts combined with memory reclaim activity.

What your security team should do

  • Prioritize kernel upgrade on all systems using FUSE filesystems
  • Monitor for kernel oops or hung tasks involving fuse_evict_inode and truncate_inode_pages
  • Apply the fix before the next scheduled maintenance window given the deadlock risk

The record

In the Linux kernel, the following vulnerability has been resolved: fuse: fix readahead reclaim deadlock Commit e26ee4efbc79 ("fuse: allocate ff->release_args only if release is needed") skips allocating ff->release_args if the server does not implement open. However in doing so, fuse_prepare_release() now skips grabbing the reference on the inode, which makes it possible for an inode to be evicted from the dcache while there are inflight readahead requests. This causes a deadlock if the server triggers reclaim while servicing the readahead request and reclaim attempts to evict the inode of the file being read ahead. Since the folio is locked during readahead, when reclaim evicts the fuse inode and fuse_evict_inode() attempts to remove all folios associated with the inode from the page cache (truncate_inode_pages_range()), reclaim will block forever waiting for the lock since readahead cannot relinquish the lock because it is itself blocked in reclaim: >>> stack_trace(1504735) folio_wait_bit_common (mm/filemap.c:1308:4) folio_lock (./include/linux/pagemap.h:1052:3) truncate_inode_pages_range (mm/truncate.c:336:10) fuse_evict_inode (fs/fuse/inode.c:161:2) evict (fs/inode.c:704:3) dentry_unlink_inode (fs/dcache.c:412:3) __dentry_kill (fs/dcache.c:615:3) shrink_kill (fs/dcache.c:1060:12) shrink_dentry_list (fs/dcache.c:1087:3) prune_dcache_sb (fs/dcache.c:1168:2) super_cache_scan (fs/super.c:221:10) do_shrink_slab (mm/shrinker.c:435:9) shrink_slab (mm/shrinker.c:626:10) shrink_node (mm/vmscan.c:5951:2) shrink_zones (mm/vmscan.c:6195:3) do_try_to_free_pages (mm/vmscan.c:6257:3) do_swap_page (mm/memory.c:4136:11) handle_pte_fault (mm/memory.c:5562:10) handle_mm_fault (mm/memory.c:5870:9) do_user_addr_fault (arch/x86/mm/fault.c:1338:10) handle_page_fault (arch/x86/mm/fault.c:1481:3) exc_page_fault (arch/x86/mm/fault.c:1539:2) asm_exc_page_fault+0x22/0x27 Fix this deadlock by allocating ff->release_args and grabbing the reference on the inode when preparing the file for release even if the server does not implement open. The inode reference will be dropped when the last reference on the fuse file is dropped (see fuse_file_put() -> fuse_release_end()).

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 5.15.198
Mageia:9 kernel 0 6.6.120-1.mga9
Mageia:9 kernel-linus 0 6.6.120-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.14-14.mga9
Mageia:9 kmod-xtables-addons 0 3.24-88.mga9
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.26.1.160000.2.7
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.26.1

Related vulnerabilities