Reference Count Leak in Linux Kernel exFAT Driver Fixed

Publication date: 2025-12-24

Last updated on: 2026-02-26

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: exfat: fix refcount leak in exfat_find Fix refcount leaks in `exfat_find` related to `exfat_get_dentry_set`. Function `exfat_get_dentry_set` would increase the reference counter of `es->bh` on success. Therefore, `exfat_put_dentry_set` must be called after `exfat_get_dentry_set` to ensure refcount consistency. This patch relocate two checks to avoid possible leaks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-24

Last Modified

2026-02-26

Generated

2026-07-06

AI Q&A

2025-12-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68351

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.14
linux	linux_kernel	6.14
linux	linux_kernel	6.14
linux	linux_kernel	From 6.13.11 (inc) to 6.14 (exc)
linux	linux_kernel	From 6.12.23 (inc) to 6.12.68 (exc)
linux	linux_kernel	From 6.12.59 (inc) to 6.13 (exc)
linux	linux_kernel	From 6.14.1 (inc) to 6.18.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a reference count leak in the Linux kernel's exFAT filesystem code, specifically in the function exfat_find related to exfat_get_dentry_set. The function exfat_get_dentry_set increases the reference counter of a buffer head (es->bh) on success, but if exfat_put_dentry_set is not called afterwards, the reference count is not properly decremented, causing a leak. The patch fixes this by relocating checks to avoid these possible leaks.

Impact Analysis

The reference count leak can lead to resource leaks in the kernel, potentially causing increased memory usage or instability in the system over time. While it may not directly lead to immediate security breaches, such leaks can degrade system performance or cause unexpected behavior.

Mitigation Strategies

To mitigate this vulnerability, update your Linux kernel to the version that includes the patch fixing the refcount leak in exfat_find related to exfat_get_dentry_set. Ensure that the kernel version you use has the fix applied to maintain reference count consistency and avoid leaks.

Hi! I’m here to help you understand CVE-2025-68351. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70