CVE-2025-68317 (GCVE-0-2025-68317)
Vulnerability from cvelistv5
Published
2025-12-16 15:39
Modified
2026-08-05 12:10
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring/zctx: check chained notif contexts Send zc only links ubuf_info for requests coming from the same context. There are some ambiguous syz reports, so let's check the assumption on notification completion.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6fe4220912d19152a26ce19713ab232f4263018d
Version: 6fe4220912d19152a26ce19713ab232f4263018d
Version: 6fe4220912d19152a26ce19713ab232f4263018d
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/notif.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aaafd17d3f4be2c15539359a5b4bfa00237f687f",
              "status": "affected",
              "version": "6fe4220912d19152a26ce19713ab232f4263018d",
              "versionType": "git"
            },
            {
              "lessThan": "d664a3ce3a604231a0b144c152a3755d03b18b60",
              "status": "affected",
              "version": "6fe4220912d19152a26ce19713ab232f4263018d",
              "versionType": "git"
            },
            {
              "lessThan": "ab3ea6eac5f45669b091309f592c4ea324003053",
              "status": "affected",
              "version": "6fe4220912d19152a26ce19713ab232f4263018d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/notif.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/zctx: check chained notif contexts\n\nSend zc only links ubuf_info for requests coming from the same context.\nThere are some ambiguous syz reports, so let\u0027s check the assumption on\nnotification completion."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A local process reaches the flaw by submitting IORING_OP_SEND_ZC or IORING_OP_SENDMSG_ZC requests through io_uring. Remote packets alone cannot construct the required cross-ring notification chain.\nAC:L - The attacker can deterministically reuse a TCP skb with small sends and MSG_MORE across two attacker-created rings. Any completion-list race is attacker-controlled through concurrent submissions and ACK or socket timing.\nPR:L - Normal io_uring setup, TCP socket creation, and zero-copy sends require no capabilities when io_uring is enabled. An ordinary unprivileged account with a small buffer within RLIMIT_MEMLOCK can reach the flaw without user namespaces.\nUI:N - The attacker creates the rings, submits both sends, and causes skb completion without any victim action.\nS:U - The corruption affects the host kernel and represents a standard local privilege-escalation boundary rather than a VM, IOMMU, or other security-scope escape.\nC:H - Wrong-context completion modifies a foreign ring\u2019s completion list without its mutex; racing a flush can corrupt its request free list and reallocate a still-linked notification, producing UAF and type confusion capable of kernel-memory disclosure. [NVD assigns C:H to the same root-cause defect](https://nvd.nist.gov/vuln/detail/CVE-2025-39963).\nI:H - The corrupted free list permits an active io_kiocb to be reused and subsequently interpreted as notification data, enabling kernel heap corruption and potentially arbitrary writes or control-flow hijacking.\nA:H - The wrong-lock completion has been observed by [syzkaller](https://syzkaller.appspot.com/bug?id=423c19d7bb9000c4ddc 1c63f9faface466fb6c35); without the diagnostic stopping execution, the resulting list corruption can cause an oops, panic, hang, or repeatable resource leak."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:10:50.931Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aaafd17d3f4be2c15539359a5b4bfa00237f687f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d664a3ce3a604231a0b144c152a3755d03b18b60"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab3ea6eac5f45669b091309f592c4ea324003053"
        }
      ],
      "title": "io_uring/zctx: check chained notif contexts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68317",
    "datePublished": "2025-12-16T15:39:47.159Z",
    "dateReserved": "2025-12-16T14:48:05.295Z",
    "dateUpdated": "2026-08-05T12:10:50.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.