CVE-2025-68265: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68265 is a use-after-free vulnerability in the Linux kernel's NVMe subsystem, specifically in the admin request_queue lifetime management. The flaw arises because NVMe namespaces can hold stale references to the controller's admin request_queue after the controller has been torn down, leading to a use-after-free condition. It was published on December 16, 2025, and affects the Linux kernel (vendor: linux, product: kernel). The CVSS category is estimated as HIGH, with an EPSS score of 0.000170 (Feedly).

The root cause is improper object lifetime management (CWE-416: Use After Free) in the Linux kernel's NVMe driver. When an NVMe controller is torn down, the admin request_queue may be freed while NVMe namespaces still hold references to it. A subsequent access to the freed request_queue — for example, via blk_queue_enter() during nvme_submit_user_cmd() — triggers a KASAN-detected slab-use-after-free read. The fix moves the controller's put operation to after all controller references have been released, ensuring the admin request_queue remains valid for the lifetime of any namespace that may access it (Feedly). The reported crash trace shows: BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 on kernel 6.13.2.

Successful exploitation of this vulnerability can cause a kernel crash (denial of service) due to the use-after-free condition in the NVMe subsystem. In more severe scenarios, a use-after-free in kernel memory may be leveraged for local privilege escalation or arbitrary kernel memory read/write, depending on heap layout and attacker control. The impact is primarily on availability (system crash) and potentially integrity/confidentiality if exploited by a local attacker with access to NVMe admin commands (Feedly).

The Linux kernel community has released patches addressing this vulnerability across multiple stable branches, referenced in commits 03b3bcd319b3, 4896491c4972, a505f0ba36ab, e7dac6817905, and e8061d02b49c on kernel.org. Downstream distributions including Ubuntu (USN-8094-1 through USN-8094-5, USN-8152-1, USN-8179-1 through USN-8179-4, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), Debian (DSA-6243-1, DLA-4561-1), SUSE (SUSE-SU-202621834-1), Oracle Linux (ELSA-2026-50112), and Amazon Linux 2023 (ALAS2023-2026-1681) have issued kernel updates. Administrators should update to the latest patched kernel version provided by their distribution as soon as possible (Ubuntu Security, SUSE Advisory, Amazon Linux).