CVE-2025-68814

CVE-2025-68814

published January 13, 2026

CVSS
—
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix filename leak in __io_openat_prep()

__io_openat_prep() allocates a struct filename using getname(). However,

for the condition of the file being installed in the fixed file table as

well as having O_CLOEXEC flag set, the function returns early. At that

point, the request doesn't have REQ_F_NEED_CLEANUP flag set. Due to this,

the memory for the newly allocated struct filename is not cleaned up,

causing a memory leak.

Fix this by setting the REQ_F_NEED_CLEANUP for the request just after the

successful getname() call, so that when the request is torn down, the

filename will be cleaned up, along with other resources needing cleanup.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Published
2026-01-13T21:16Z
References (8)
EPSS history
Timeline
  • 13 JAN 15:29Z
    io_uring: fix filename leak in __io_openat_prep()
    cvelistv5