{"id":"CVE-2025-68810","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-68810","generatedAt":"2026-10-28T02:20:49.505Z","title":"In the Linux kernel, the following vulnerability has been resolved: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot Reject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was initially created with a guest_memfd binding, as…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot\n\nReject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was\ninitially created with a guest_memfd binding, as KVM doesn't support\ntoggling KVM_MEM_GUEST_MEMFD on existing memslots.  KVM prevents enabling\nKVM_MEM_GUEST_MEMFD, but doesn't prevent clearing the flag.\n\nFailure to reject the new memslot results in a use-after-free due to KVM\nnot unbinding from the guest_memfd instance.  Unbinding on a FLAGS_ONLY\nchange is easy enough, and can/will be done as a hardening measure (in\nanticipation of KVM supporting dirty logging on guest_memfd at some point),\nbut fixing the use-after-free would only address the immediate symptom.\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x362/0x400 [kvm]\n  Write of size 8 at addr ffff8881111ae908 by task repro/745\n\n  CPU: 7 UID: 1000 PID: 745 Comm: repro Not tainted 6.18.0-rc6-115d5de2eef3-next-kasan #3 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x51/0x60\n   print_report+0xcb/0x5c0\n   kasan_report+0xb4/0xe0\n   kvm_gmem_release+0x362/0x400 [kvm]\n   __fput+0x2fa/0x9d0\n   task_work_run+0x12c/0x200\n   do_exit+0x6ae/0x2100\n   do_group_exit+0xa8/0x230\n   __x64_sys_exit_group+0x3a/0x50\n   x64_sys_call+0x737/0x740\n   do_syscall_64+0x5b/0x900\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f581f2eac31\n   </TASK>\n\n  Allocated by task 745 on cpu 6 at 9.746971s:\n   kasan_save_stack+0x20/0x40\n   kasan_save_track+0x13/0x50\n   __kasan_kmalloc+0x77/0x90\n   kvm_set_memory_region.part.0+0x652/0x1110 [kvm]\n   kvm_vm_ioctl+0x14b0/0x3290 [kvm]\n   __x64_sys_ioctl+0x129/0x1a0\n   do_syscall_64+0x5b/0x900\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n  Freed by task 745 on cpu 6 at 9.747467s:\n   kasan_save_stack+0x20/0x40\n   kasan_save_track+0x13/0x50\n   __kasan_save_free_info+0x37/0x50\n   __kasan_slab_free+0x3b/0x60\n   kfree+0xf5/0x440\n   kvm_set_memslot+0x3c2/0x1160 [kvm]\n   kvm_set_memory_region.part.0+0x86a/0x1110 [kvm]\n   kvm_vm_ioctl+0x14b0/0x3290 [kvm]\n   __x64_sys_ioctl+0x129/0x1a0\n   do_syscall_64+0x5b/0x900\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53","published":"2026-01-13T16:16:03.000Z","lastModified":"2026-07-30T06:24:47.000Z","status":"Deferred","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":[],"affected":[],"epss":{"score":0.00148,"percentile":0.0398,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://git.kernel.org/stable/c/89dbbe6ff323fc34659621a577fe0af913f47386","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9935df5333aa503a18de5071f53762b65c783c4c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb51bef465d8ec60a968507330e01020e35dc127","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-68810","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}