CVE-2025-68805

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix io-uring list corruption for terminated non-committed requests

When a request is terminated before it has been committed, the request is not removed from the queue's list. This leaves a dangling list entry that leads to list corruption and use-after-free issues.

Remove the request from the queue's list for terminated non-committed requests.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= c090c8abae4b6b77a1bee116aa6c385456ebef96, < a6d1f1ace16d0e777a85f84267160052d3499b6e; >= c090c8abae4b6b77a1bee116aa6c385456ebef96, < 95c39eef7c2b666026c69ab5b30471da94ea2874
LinuxLinux6.14

References

Timeline

Published
Jan 13, 2026
Last modified
Jul 30, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-688067.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix buffer validation by including null terminator size in EA leCVE-2025-68807In the Linux kernel, the following vulnerability has been resolved: block: fix race between wbt_enable_default and IO submission When wbt_CVE-2025-688087.8In the Linux kernel, the following vulnerability has been resolved: media: vidtv: initialize local pointers upon transfer of memory ownershCVE-2025-688099.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-onCVE-2025-68818.8A vulnerability was found in D-Link DI-8100 16.07.21. It has been rated as critical. Affected by this issue is some unknown functionality ofCVE-2025-688107.8In the Linux kernel, the following vulnerability has been resolved: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot RejeCVE-2025-688119.8In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_raCVE-2025-68813In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path iCVE-2025-68814In the Linux kernel, the following vulnerability has been resolved: io_uring: fix filename leak in __io_openat_prep() __io_openat_prep() CVE-2025-688157.8In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Remove drr class from the active list if it changes to CVE-2025-68816In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validation CVE-2025-688177.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
CVE-2025-68805: High severity, CVSS 7.8 | Vulnix