CVE-2025-68348: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68348 is a memory leak vulnerability in the Linux kernel's block subsystem, specifically in the __blkdev_issue_zero_pages() function. The flaw was introduced when the BLKDEV_ZERO_KILLABLE flag is set and a fatal signal is pending: a bio object was allocated via bio_alloc() before the fatal signal check, and if the signal was detected, the loop would break without freeing or chaining the allocated bio, resulting in a kernel memory leak. The vulnerability affects Linux kernel versions from commit bf86bcdb4012 up to the fixes applied in stable branches, with patches landing in kernel versions 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. It was published on December 24, 2025, and carries an estimated CVSS severity of Medium (Feedly, EUVD).

The root cause is a missing resource cleanup path (CWE-401: Missing Release of Memory after Effective Lifetime) in the __blkdev_issue_zero_pages() function within the Linux kernel's block layer. When BLKDEV_ZERO_KILLABLE is set, the function is expected to abort on fatal signals; however, the original code called bio_alloc() to allocate a bio structure before performing the fatal signal check. If a fatal signal was pending, the loop exited immediately without either submitting or freeing the newly allocated bio, leaking kernel memory. The fix reorders the logic to check for fatal signals before calling bio_alloc(), mirroring the already-correct pattern used in the sibling function __blkdev_issue_write_zeroes() (Feedly, EUVD).

The primary impact is a kernel memory leak, which can gradually exhaust available kernel memory on affected systems over time, potentially leading to degraded system performance or denial of service if the leak is triggered repeatedly. The vulnerability is confined to the block subsystem and does not directly enable privilege escalation, arbitrary code execution, or data exfiltration. Systems performing frequent killable block zeroing operations (e.g., storage management workloads) are most at risk of observable resource exhaustion (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable kernel versions: 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. Administrators should update to a patched kernel version as soon as possible. The relevant upstream fix commits are 453e4b0c84d0, 7957635c679e, 7193407bc445, and f7e3f852a42d (EUVD, Feedly). No configuration-based workaround is available; upgrading the kernel is the only remediation. Oracle Linux has also issued an advisory (ELSA-2026-50112) incorporating this fix (Linux Security).