CVE-2025-68784: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68784 is a Use-After-Free (UAF) vulnerability in the Linux kernel's XFS filesystem subsystem, specifically within the extended attribute (xattr) repair code path. The flaw exists because xchk_setup_xattr_buf can allocate a new value buffer, causing any prior reference to ab->value to become a dangling pointer. It was published on January 13, 2026, and affects Linux kernel versions from commit e47dcf113ae3 up to the fixes applied in stable releases 6.12.64 and 6.18.3, as well as 6.19-rc2. Feedly estimates the severity as HIGH, though NVD has not yet assigned a formal CVSS score (Red Hat CVE, Feedly).

The root cause is a Use-After-Free condition (CWE-416) in the XFS xattr repair subsystem. When xchk_setup_xattr_buf is called, it may reallocate the value buffer, invalidating any pointer to ab->value that was captured before the call. The fix moves the assignment of ab->value to after the buffer setup call, ensuring the pointer always references valid memory. Three stable kernel commits address this issue across different kernel branches (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3).

Exploitation of this UAF vulnerability could allow a local attacker to read freed kernel memory (information disclosure), corrupt kernel heap memory, or potentially achieve privilege escalation to root depending on how the dangling pointer is subsequently used. The vulnerability is confined to systems using the XFS filesystem with xattr repair operations active (e.g., during xfs_scrub or similar repair tooling). Availability impact in the form of kernel panic or system crash is also possible if the freed memory is accessed in an unexpected state (Red Hat CVE).

Apply the upstream kernel patches that fix this issue: stable commits 1e2d3aa19c79, 5990fd75694, and d29ed9ff972a for the respective kernel branches. Fixed versions include Linux kernel 6.12.64, 6.18.3, and 6.19-rc2. Downstream distributions have issued advisories and updated packages — Ubuntu has released fixes via USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1. Users should update to the latest patched kernel version provided by their distribution as soon as possible (Ubuntu USN-8177-1, Ubuntu USN-8183-1, Red Hat CVE).

Red Hat has acknowledged the vulnerability and published a CVE tracking page. Ubuntu has issued multiple security notices (USN-8177-1/2, USN-8183-1/2, USN-8245-1, USN-8257-1) addressing the issue across various kernel flavors. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability (Red Hat CVE, Ubuntu USN-8177-1).