CVE-2025-68295: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68295 is a memory leak vulnerability in the Linux kernel's SMB client (cifs) subsystem, specifically within the cifs_construct_tcon() function. When a multiuser CIFS mount is configured with a domain= parameter and cifscreds is used, cifs_set_cifscreds() sets ctx->domainname via kstrdup, but this allocation is never freed before the function returns, resulting in a kernel memory leak. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from 5.3 onward, with fixes backported to stable branches including 5.10.247, 5.15.197, 6.1.159, 6.6.119, 6.12.61, 6.17.11, and 6.18. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the cifs_construct_tcon() function of the Linux kernel's CIFS/SMB client driver. When cifs_set_cifscreds() is called during tcon construction for a multiuser mount with a domain credential, it duplicates the domain name string into ctx->domainname using kstrdup. However, the function exits without freeing this allocation, leaving an unreferenced kernel heap object. The leak is triggered by a local, low-privileged user performing file operations (e.g., ls) on a multiuser CIFS mount with domain credentials configured via cifscreds. The backtrace reported by kmemleak traces through cifs_sb_tlink → cifs_get_fattr → cifs_revalidate_dentry_attr → cifs_getattr → vfs_statx (Red Hat CVE).

Successful triggering of this vulnerability causes a kernel heap memory leak, gradually exhausting available kernel memory over time. The primary impact is on availability — repeated triggering by a local user can degrade system performance and potentially lead to out-of-memory conditions on affected systems. There is no confidentiality or integrity impact, as the vulnerability does not expose sensitive data or allow unauthorized modification of system state (Red Hat CVE, Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Users should update to the following fixed versions or later: 5.10.247, 5.15.197, 6.1.159, 6.6.119, 6.12.61, 6.17.11, or 6.18. Distribution-specific updates have been issued by Red Hat, Ubuntu (USN-8094-x, USN-8096-x, USN-8152-1), Debian (DLA-4436-1), SUSE, Amazon Linux 2, and Microsoft Azure Linux 3. As a workaround, avoiding the combination of multiuser CIFS mounts with the domain= mount option and cifscreds eliminates the trigger condition until patching is feasible (Red Hat CVE, Ubuntu USN-8096-1, Debian LTS).