CVE-2025-68743: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68743 is a logic flaw in the Linux kernel's Microsoft Hypervisor (mshv) subsystem related to an incorrect memory region overlap check during partition memory region creation. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from commit 621191d709b1 up to the fixes applied in 6.17.13, 6.18.2, and 6.19-rc1. The flaw was estimated as Medium severity by Feedly, with an EPSS score of 0.000170 (Feedly, EUVD).

The root cause is an incorrect boundary check (CWE-193: Off-by-One Error / improper range validation) in the mshv subsystem's memory region overlap detection logic. The original code only verified whether the beginning or end of a new memory region fell within an existing region, failing to account for the case where a new region completely encompasses an existing one (i.e., begins before and ends after it). This allows userspace to specify overlapping memory regions that bypass the guard, potentially causing undefined kernel behavior. The fix replaces the flawed check with a proper range intersection check against guest frame numbers (gfns) and user-space addresses (uaddrs) for each existing region, and removes the now-unused mshv_partition_region_by_uaddr() function (Feedly, Kernel Patch 1, Kernel Patch 2).

Exploitation of this vulnerability could allow a local userspace process with access to the mshv partition interface to create overlapping memory regions in the hypervisor partition, potentially leading to memory corruption, unexpected kernel behavior, or information disclosure within the hypervisor-managed memory space. The impact is primarily limited to systems running the Linux kernel with the mshv (Microsoft Hypervisor) driver enabled, which is relevant to Azure Linux or similar environments using the Microsoft Hyper-V stack. Integrity and availability of the hypervisor partition memory management are the primary concerns, with confidentiality impact possible if overlapping regions expose guest memory contents (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in versions 6.17.13, 6.18.2, and 6.19-rc1. Administrators running affected kernel versions with the mshv subsystem enabled should update to one of these patched releases. The specific fix commits are ba9eb9b86d23 (for the 6.17.x stable branch), ab3e7a78d83a (for the 6.18.x stable branch), and 2183924dd834 (for mainline/6.19-rc1). As a workaround where patching is not immediately possible, restricting unprivileged userspace access to the mshv partition interface can reduce exposure (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).