CVE-2025-68810

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot

Reject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was

initially created with a guest_memfd binding, as KVM doesn't support

toggling KVM_MEM_GUEST_MEMFD on existing memslots. KVM prevents enabling

KVM_MEM_GUEST_MEMFD, but doesn't prevent clearing the flag.

Failure to reject the new memslot results in a use-after-free due to KVM

not unbinding from the guest_memfd instance. Unbinding on a FLAGS_ONLY

change is easy enough, and can/will be done as a hardening measure (in

anticipation of KVM supporting dirty logging on guest_memfd at some point),

but fixing the use-after-free would only address the immediate symptom.

==================================================================

BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x362/0x400 [kvm]

Write of size 8 at addr ffff8881111ae908 by task repro/745

CPU: 7 UID: 1000 PID:

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References