CVE-2025-68262: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68262 is a double-free vulnerability in the Linux kernel's crypto/zstd module, occurring during per-CPU stream cleanup. The bug is triggered when multiple cryptographic transform (tfm) instances are allocated and freed, causing each tfm's exit routine (zstd_exit()) to attempt freeing the same shared per-CPU zstd streams multiple times. Affected software is the Linux kernel across multiple stable branches, with patches applied to stable commits. It was disclosed on December 16, 2025, and carries a CVSS category estimate of Medium (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper lifecycle management of per-CPU zstd stream contexts (CWE-415: Double Free). The zstd_streams per-CPU data structures are freed inside zstd_exit(), which is called on every tfm destruction rather than being managed at the module level. When multiple tfms share the same per-CPU streams and are destroyed concurrently or sequentially, each destruction attempt frees already-freed memory, corrupting kernel page state. The resulting kernel stack trace shows the call path: crypto_acomp_free_streams → crypto_acomp_exit_tfm → crypto_destroy_tfm, ultimately triggering a BUG: Bad page state kernel error (Red Hat Bugzilla). The fix changes the lifecycle of zstd_streams so they are freed only once during module-level cleanup rather than per-tfm teardown.

Successful triggering of this vulnerability causes kernel memory corruption, manifesting as bad page state errors and potential kernel panics, which directly impacts system availability. Systems using the crypto/zstd module — particularly those running workloads like Btrfs with zstd compression that allocate multiple concurrent cryptographic transforms — are at risk of unpredictable kernel crashes. There is no evidence of confidentiality or integrity impact beyond the memory corruption and resulting instability (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at 0.017%, reflecting minimal exploitation probability. The bug is triggered by a specific kernel usage pattern (multiple tfm allocations/frees with the zstd crypto module) rather than by external attacker input, limiting its exploitability to local or privileged contexts (Red Hat CVE).

• Logs: Kernel log entries containing BUG: Bad page state in process with references to pfn values and nonzero entire_mapcount; stack traces involving crypto_acomp_free_streams, crypto_acomp_exit_tfm, or crypto_destroy_tfm.
• Process: Kernel worker processes (e.g., kworker/u16:1) associated with Btrfs delalloc workqueues (btrfs-delalloc btrfs_work_helper) crashing or producing tainted kernel messages (Tainted: G B).
• System Behavior: Unexpected kernel panics or system reboots on hosts using Btrfs with zstd compression or other workloads that allocate multiple zstd crypto transforms simultaneously.

The fix has been committed to multiple Linux kernel stable branches (commits 48bc9da3c97c, dc0f4509b0ed, e983feaa79de), modifying zstd_streams lifecycle management to free streams only once at module cleanup. Users should update to the latest patched kernel version for their distribution. Ubuntu has released fixes in security notices USN-8094-1 through USN-8094-5 and USN-8152-1 (Ubuntu USN-8094-1, Ubuntu USN-8152-1). As a temporary workaround, minimizing workloads that create and destroy multiple concurrent zstd cryptographic transforms (e.g., limiting Btrfs zstd compression under heavy I/O) can reduce exposure until patching is complete (Red Hat Bugzilla).

Red Hat tracked the issue via their security response process and assigned it medium severity, with the bug filed in their Bugzilla system on December 16, 2025 (Red Hat Bugzilla). Ubuntu issued multiple security notices (USN-8094-1 through USN-8094-5, USN-8152-1) addressing this and related kernel vulnerabilities (Ubuntu USN-8094-1). No significant broader media coverage or notable researcher commentary has been identified beyond standard distribution security advisories.