CVE-2025-68791: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68791 is a reference count leak vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) subsystem, specifically in the fuse-over-io-uring argument copy path. The flaw involves a missing copy_finish call during FUSE argument copies, which can result in a reference count leak of payload pages. It was published on January 13, 2026, and affects Linux kernel versions starting from commit c090c8abae4b6b77a1bee116aa6c385456ebef96 up to the patched commits (EUVD). No official CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium with an EPSS score of 0.000180 (Feedly).

The root cause is a missing call to copy_finish() in the error handling path of FUSE argument copies when using the fuse-over-io-uring interface, leading to a reference count leak of payload pages (CWE classification not formally assigned by NVD). When an error occurs during argument copying in the io_uring-backed FUSE path, the code fails to properly release references to the associated memory pages, causing them to remain pinned in memory. The fix was applied in two stable kernel commits (6e0d7f7f4a43ac8868e98c87ecf48805aa8c24dd and b79938863f436960eff209130f025c4bd3026bf8) and also included in Linux 6.19-rc1 and 6.18.3 (kernel.org patch 1, kernel.org patch 2).

The primary impact of this vulnerability is a memory resource leak — specifically, payload pages whose reference counts are not properly decremented may remain pinned indefinitely, potentially leading to memory exhaustion or degraded system availability over time. This is a local kernel-level issue affecting systems using the FUSE filesystem with io-uring support. There is no known direct path to privilege escalation, remote code execution, or data exfiltration based on currently available information (Feedly, EUVD).

The vulnerability is fixed in Linux kernel stable commits 6e0d7f7f4a43ac8868e98c87ecf48805aa8c24dd and b79938863f436960eff209130f025c4bd3026bf8, as well as in kernel versions 6.18.3 and 6.19-rc1 (kernel.org patch 1, kernel.org patch 2). Ubuntu has addressed this in security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 (Ubuntu USN-8177-1, Ubuntu USN-8183-1). Users should update to a patched kernel version; as a temporary workaround, disabling io-uring support or FUSE-over-io-uring if not required may reduce exposure.