BaseFortify

Publication date: 2025-12-16

Last updated on: 2025-12-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/net: ensure vectored buffer node import is tied to notification When support for vectored registered buffers was added, the import itself is using 'req' rather than the notification io_kiocb, sr->notif. For non-vectored imports, sr->notif is correctly used. This is important as the lifetime of the two may be different. Use the correct io_kiocb for the vectored buffer import.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-16

Last Modified

2025-12-18

Generated

2026-07-06

AI Q&A

2025-12-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68294

EUVD

EUVD-2025-203786

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel relates to the io_uring/net subsystem where vectored registered buffers were imported using an incorrect reference ('req') instead of the proper notification io_kiocb ('sr->notif'). This mismatch can cause issues because the lifetimes of these references differ, potentially leading to improper handling of vectored buffer imports. The fix ensures that the correct io_kiocb is used for vectored buffer imports.

Impact Analysis

The vulnerability could lead to improper handling of vectored buffer imports in the Linux kernel's io_uring/net subsystem, which might cause unexpected behavior or resource management issues. However, specific impacts such as data corruption, crashes, or security breaches are not detailed in the provided information.

Hi! I’m here to help you understand CVE-2025-68294. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70