CVE-2025-68351: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68351 is a reference count leak vulnerability in the Linux kernel's exFAT file system driver, specifically within the exfat_find function. The flaw arises from improper management of the es->bh (buffer head) reference counter in exfat_get_dentry_set: the function increments the reference counter on success, but two subsequent checks were not properly positioned to guarantee that exfat_put_dentry_set is always called, resulting in refcount leaks. It affects Linux kernel versions 6.12.23–6.12.67, 6.12.59–6.12.x, 6.13.11–6.13.x, 6.14.1–6.18.1, as well as 6.14, 6.14-rc6, and 6.14-rc7. The vulnerability was published on December 24, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as a resource management error (CWE-401: Missing Release of Memory after Effective Lifetime), specifically a reference count leak in the kernel's exFAT file system handling. When exfat_get_dentry_set succeeds, it increments the reference counter of es->bh; however, two conditional checks in exfat_find were positioned such that execution could exit the function without calling exfat_put_dentry_set, leaving the reference count elevated and the buffer head unreleased. The attack vector is local, requiring low privileges and no user interaction — an attacker with a local account on a system with exFAT file system support enabled could trigger the leak by performing specific exFAT file system operations. Patches relocating the two checks to ensure exfat_put_dentry_set is always called are available in the Linux kernel stable tree (Red Hat CVE, kernel patch 1, kernel patch 2).

Successful exploitation of this vulnerability can lead to memory exhaustion and system instability due to the accumulating unreleased buffer head references. The primary impact is on availability (CVSS availability impact: High), as repeated triggering of the leak can degrade or crash the affected system. There is no direct confidentiality or integrity impact, and the vulnerability does not provide a direct path for privilege escalation or lateral movement (Red Hat CVE, Feedly).

There are no known public proof-of-concept exploits and no evidence of active in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, further limiting the practical attack surface.

The primary remediation is to upgrade the Linux kernel to a fixed version: 6.12.68 or later (for the 6.12.x stable branch), 6.18.2 or later (for the 6.14.x/6.18.x branch), or 6.19-rc1 or later for development versions (Red Hat CVE, kernel patch 1, kernel patch 2). Downstream distributions including Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1, USN-8278-1, USN-8278-2, USN-8289-1, USN-8296-1, USN-8296-2, USN-8393-1) and Oracle Linux (ELSA-2026-50160, ELSA-2026-50232) have issued patched kernel packages. As a temporary workaround, administrators can disable exFAT file system support (e.g., via modprobe -r exfat or blacklisting the module) on systems where it is not operationally required, and monitor system memory usage for signs of resource exhaustion.