CVE-2025-68300: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68300 is a reference leak vulnerability in the Linux kernel's filesystem namespace subsystem, specifically in the grab_requested_mnt_ns() function. The bug arises because lookup_mnt_ns() already increments the reference count on mnt_ns, and grab_requested_mnt_ns() incorrectly takes an additional reference, resulting in a reference count leak. Affected kernel versions span commit ranges including 6.12.59–6.12.61 and 6.17.9–6.17.11. The vulnerability was published on December 16, 2025, and is estimated as Medium severity with an EPSS score of 0.00017 (Feedly, EUVD).

The root cause is a resource management error (CWE-772: Missing Release of Resource after Effective Lifetime) in fs/namespace.c. When grab_requested_mnt_ns() calls lookup_mnt_ns(), the latter already acquires a reference on the mount namespace object (mnt_ns); the calling function then redundantly takes another reference, causing the reference count to never reach zero and the object to never be freed. This is a kernel-internal logic error that does not require any special privileges or network access to trigger — it can be reached through normal filesystem namespace operations. The fix removes the extra reference acquisition in grab_requested_mnt_ns() (Feedly, Linux Kernel Git).

The primary impact is a kernel memory leak: each time the vulnerable code path is exercised, a mount namespace object is not properly freed, gradually consuming kernel memory. Over time, this can lead to resource exhaustion and potential denial of service on affected systems. There is no direct evidence of confidentiality or integrity impact, and lateral movement or data exfiltration are not associated with this vulnerability (Feedly, EUVD).

The Linux kernel maintainers have released patches addressing this issue in stable branches. Fixed commits include 4a16b2a0c1f033f95f5d0b98b9e40e8bf7c4c2c5 (for the 6.12.x series, targeting 6.12.61+), fe256e59b8e7f126b2464ee32bd9fee131f0a883, and 7b6dcd9bfd869eee7693e45b1817dac8c56e5f86 (for the 6.17.x series, targeting 6.17.11+). Ubuntu has issued security notices USN-8094-1 through USN-8094-5 and USN-8152-1 addressing this and related kernel vulnerabilities. Administrators should update to a patched kernel version as provided by their Linux distribution (Ubuntu USN-8094-1, Ubuntu USN-8152-1, Linux Kernel Git).

The vulnerability has been picked up by standard Linux security advisory channels, including Ubuntu security notices (USN-8094-1 through USN-8094-5, USN-8152-1), Oracle Linux advisories, and SUSE CVE tracking. Coverage is routine and consistent with a low-severity kernel maintenance fix, with no notable researcher commentary or social media discussion identified (Ubuntu USN-8094-1, Feedly).