CVE-2025-68805: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68805 is a use-after-free and list corruption vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) subsystem, specifically affecting io-uring request handling. When a FUSE request is terminated before it has been committed, it is not properly removed from the queue's linked list, leaving a dangling list entry that can lead to list corruption and use-after-free conditions. The vulnerability was published on January 13, 2026, and affects Linux kernel versions prior to the patches applied in commits 95c39eef7c2b and a6d1f1ace16d (NVD). NVD has not yet assigned a CVSS score; Feedly estimates the severity as Medium (Feedly).

The root cause is improper cleanup of linked list entries in the Linux kernel's FUSE io-uring code path (CWE classification not formally assigned by NVD). When a FUSE request is terminated prior to being committed to the queue, the kernel fails to call the appropriate list removal routine, leaving a stale pointer in the queue's doubly-linked list. This dangling entry can subsequently be dereferenced or manipulated, resulting in use-after-free (UAF) memory corruption. The fix, applied in two stable-tree commits (95c39eef7c2b666026c69ab5b30471da94ea2874 and a6d1f1ace16d0e777a85f84267160052d3499b6e), explicitly removes the request from the queue list upon early termination (NVD, kernel.org patch 1, kernel.org patch 2).

Successful exploitation of this vulnerability could allow a local attacker to cause kernel memory corruption through use-after-free conditions, potentially leading to a system crash (denial of service) or, in more severe scenarios, privilege escalation to root. The vulnerability is confined to systems where both FUSE and io-uring are in use, limiting the affected asset scope to Linux systems with these subsystems enabled. Data confidentiality and integrity may be at risk if an attacker can leverage the UAF to execute arbitrary kernel code (NVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68805. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system running a vulnerable kernel with both FUSE and io-uring enabled, which significantly limits the attack surface.

The Linux kernel upstream has addressed this vulnerability in two stable-tree commits: 95c39eef7c2b666026c69ab5b30471da94ea2874 and a6d1f1ace16d0e777a85f84267160052d3499b6e. Patched versions include Linux kernel 6.18.3 and 6.19-rc1 (Feedly/EUVD). Ubuntu has issued multiple security notices addressing this CVE, including USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 (Ubuntu USN-8177-1, Ubuntu USN-8183-1). Users should update to a patched kernel version as soon as possible; as a temporary workaround, disabling io-uring or FUSE where not required can reduce exposure.