CVE-2025-68294 io_uring/net: ensure vectored buffer node import is tied to notification
A use-after-free vulnerability in the Linux kernel's io_uring subsystem allows attackers to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68294?
CVE-2025-68294 is a high-severity use after free vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
io_uring/net: ensure vectored buffer node import is tied to notification
When support for vectored registered buffers was added, the import itself is using 'req' rather than the notification io_kiocb, sr->notif. For non-vectored imports, sr->notif is correctly used. This is important as the lifetime of the two may be different. Use the correct io_kiocb for the vectored buffer import.
Which versions are affected by CVE-2025-68294?
How do I fix CVE-2025-68294?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-68294 being exploited?
There is no known exploitation of CVE-2025-68294 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68294, DEBIAN-CVE-2025-68294, GHSA-px9x-jrmf-jcg2, UBUNTU-CVE-2025-68294.