GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68810 (GCVE-0-2025-68810)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:29 – Updated: 2026-08-05 12:11
VLAI
Title
KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot Reject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was initially created with a guest_memfd binding, as KVM doesn't support toggling KVM_MEM_GUEST_MEMFD on existing memslots. KVM prevents enabling KVM_MEM_GUEST_MEMFD, but doesn't prevent clearing the flag. Failure to reject the new memslot results in a use-after-free due to KVM not unbinding from the guest_memfd instance. Unbinding on a FLAGS_ONLY change is easy enough, and can/will be done as a hardening measure (in anticipation of KVM supporting dirty logging on guest_memfd at some point), but fixing the use-after-free would only address the immediate symptom. ================================================================== BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x362/0x400 [kvm] Write of size 8 at addr ffff8881111ae908 by task repro/745 CPU: 7 UID: 1000 PID: 745 Comm: repro Not tainted 6.18.0-rc6-115d5de2eef3-next-kasan #3 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x51/0x60 print_report+0xcb/0x5c0 kasan_report+0xb4/0xe0 kvm_gmem_release+0x362/0x400 [kvm] __fput+0x2fa/0x9d0 task_work_run+0x12c/0x200 do_exit+0x6ae/0x2100 do_group_exit+0xa8/0x230 __x64_sys_exit_group+0x3a/0x50 x64_sys_call+0x737/0x740 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f581f2eac31 </TASK> Allocated by task 745 on cpu 6 at 9.746971s: kasan_save_stack+0x20/0x40 kasan_save_track+0x13/0x50 __kasan_kmalloc+0x77/0x90 kvm_set_memory_region.part.0+0x652/0x1110 [kvm] kvm_vm_ioctl+0x14b0/0x3290 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 745 on cpu 6 at 9.747467s: kasan_save_stack+0x20/0x40 kasan_save_track+0x13/0x50 __kasan_save_free_info+0x37/0x50 __kasan_slab_free+0x3b/0x60 kfree+0xf5/0x440 kvm_set_memslot+0x3c2/0x1160 [kvm] kvm_set_memory_region.part.0+0x86a/0x1110 [kvm] kvm_vm_ioctl+0x14b0/0x3290 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a7800aa80ea4d5356b8474c2302812e9d4926fa6 , < 89dbbe6ff323fc34659621a577fe0af913f47386 (git)
Affected: a7800aa80ea4d5356b8474c2302812e9d4926fa6 , < cb51bef465d8ec60a968507330e01020e35dc127 (git)
Affected: a7800aa80ea4d5356b8474c2302812e9d4926fa6 , < 9935df5333aa503a18de5071f53762b65c783c4c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "virt/kvm/kvm_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "89dbbe6ff323fc34659621a577fe0af913f47386",
              "status": "affected",
              "version": "a7800aa80ea4d5356b8474c2302812e9d4926fa6",
              "versionType": "git"
            },
            {
              "lessThan": "cb51bef465d8ec60a968507330e01020e35dc127",
              "status": "affected",
              "version": "a7800aa80ea4d5356b8474c2302812e9d4926fa6",
              "versionType": "git"
            },
            {
              "lessThan": "9935df5333aa503a18de5071f53762b65c783c4c",
              "status": "affected",
              "version": "a7800aa80ea4d5356b8474c2302812e9d4926fa6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "virt/kvm/kvm_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot\n\nReject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was\ninitially created with a guest_memfd binding, as KVM doesn\u0027t support\ntoggling KVM_MEM_GUEST_MEMFD on existing memslots.  KVM prevents enabling\nKVM_MEM_GUEST_MEMFD, but doesn\u0027t prevent clearing the flag.\n\nFailure to reject the new memslot results in a use-after-free due to KVM\nnot unbinding from the guest_memfd instance.  Unbinding on a FLAGS_ONLY\nchange is easy enough, and can/will be done as a hardening measure (in\nanticipation of KVM supporting dirty logging on guest_memfd at some point),\nbut fixing the use-after-free would only address the immediate symptom.\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x362/0x400 [kvm]\n  Write of size 8 at addr ffff8881111ae908 by task repro/745\n\n  CPU: 7 UID: 1000 PID: 745 Comm: repro Not tainted 6.18.0-rc6-115d5de2eef3-next-kasan #3 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x51/0x60\n   print_report+0xcb/0x5c0\n   kasan_report+0xb4/0xe0\n   kvm_gmem_release+0x362/0x400 [kvm]\n   __fput+0x2fa/0x9d0\n   task_work_run+0x12c/0x200\n   do_exit+0x6ae/0x2100\n   do_group_exit+0xa8/0x230\n   __x64_sys_exit_group+0x3a/0x50\n   x64_sys_call+0x737/0x740\n   do_syscall_64+0x5b/0x900\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f581f2eac31\n   \u003c/TASK\u003e\n\n  Allocated by task 745 on cpu 6 at 9.746971s:\n   kasan_save_stack+0x20/0x40\n   kasan_save_track+0x13/0x50\n   __kasan_kmalloc+0x77/0x90\n   kvm_set_memory_region.part.0+0x652/0x1110 [kvm]\n   kvm_vm_ioctl+0x14b0/0x3290 [kvm]\n   __x64_sys_ioctl+0x129/0x1a0\n   do_syscall_64+0x5b/0x900\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n  Freed by task 745 on cpu 6 at 9.747467s:\n   kasan_save_stack+0x20/0x40\n   kasan_save_track+0x13/0x50\n   __kasan_save_free_info+0x37/0x50\n   __kasan_slab_free+0x3b/0x60\n   kfree+0xf5/0x440\n   kvm_set_memslot+0x3c2/0x1160 [kvm]\n   kvm_set_memory_region.part.0+0x86a/0x1110 [kvm]\n   kvm_vm_ioctl+0x14b0/0x3290 [kvm]\n   __x64_sys_ioctl+0x129/0x1a0\n   do_syscall_64+0x5b/0x900\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local ioctl operations on a KVM VM file descriptor followed by closing the guest_memfd; no guest or network path reaches the flaw.\nAC:L - The attacker deterministically creates and binds a guest_memfd slot, clears its flag, reclaims the freed allocation, and closes the file. No race or condition outside the attacker\u2019s control is required.\nPR:L - The attacker needs access to /dev/kvm and an attacker-owned VM descriptor, typically granted through the kvm group or a device ACL. None of the relevant ioctls requires a capability or init-namespace root.\nUI:N - The attacker performs the complete ioctl and file-release sequence without any victim action.\nS:U - The vulnerable interface is invoked by host userspace rather than a guest, and the resulting host-kernel compromise remains within the host OS security authority.\nC:H - The reclaimable stale memslot is subsequently read during MMU invalidation, including attacker-influenceable bounds and architecture pointers. Exploiting this kernel UAF can expose arbitrary host kernel or VM memory.\nI:H - Release performs an attacker-timed eight-byte NULL write into a reclaimed allocation and subsequently follows stale MMU metadata. Heap shaping can turn this into arbitrary kernel-state corruption or host code execution.\nA:H - The flaw demonstrably causes a slab use-after-free write, and the x86 path can also issue a warning before release. Repeated triggering can corrupt MMU state, oops, or panic the host kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:41.602Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/89dbbe6ff323fc34659621a577fe0af913f47386"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb51bef465d8ec60a968507330e01020e35dc127"
        },
        {
          "url": "https://git.kernel.org/stable/c/9935df5333aa503a18de5071f53762b65c783c4c"
        }
      ],
      "title": "KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68810",
    "datePublished": "2026-01-13T15:29:16.475Z",
    "dateReserved": "2025-12-24T10:30:51.047Z",
    "dateUpdated": "2026-08-05T12:11:41.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68810",
      "date": "2026-09-16",
      "epss": "0.00145",
      "percentile": "0.04136"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68810\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:03.190\",\"lastModified\":\"2026-07-30T06:24:46.630\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot\\n\\nReject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was\\ninitially created with a guest_memfd binding, as KVM doesn\u0027t support\\ntoggling KVM_MEM_GUEST_MEMFD on existing memslots.  KVM prevents enabling\\nKVM_MEM_GUEST_MEMFD, but doesn\u0027t prevent clearing the flag.\\n\\nFailure to reject the new memslot results in a use-after-free due to KVM\\nnot unbinding from the guest_memfd instance.  Unbinding on a FLAGS_ONLY\\nchange is easy enough, and can/will be done as a hardening measure (in\\nanticipation of KVM supporting dirty logging on guest_memfd at some point),\\nbut fixing the use-after-free would only address the immediate symptom.\\n\\n  ==================================================================\\n  BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x362/0x400 [kvm]\\n  Write of size 8 at addr ffff8881111ae908 by task repro/745\\n\\n  CPU: 7 UID: 1000 PID: 745 Comm: repro Not tainted 6.18.0-rc6-115d5de2eef3-next-kasan #3 NONE\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x51/0x60\\n   print_report+0xcb/0x5c0\\n   kasan_report+0xb4/0xe0\\n   kvm_gmem_release+0x362/0x400 [kvm]\\n   __fput+0x2fa/0x9d0\\n   task_work_run+0x12c/0x200\\n   do_exit+0x6ae/0x2100\\n   do_group_exit+0xa8/0x230\\n   __x64_sys_exit_group+0x3a/0x50\\n   x64_sys_call+0x737/0x740\\n   do_syscall_64+0x5b/0x900\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n  RIP: 0033:0x7f581f2eac31\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 745 on cpu 6 at 9.746971s:\\n   kasan_save_stack+0x20/0x40\\n   kasan_save_track+0x13/0x50\\n   __kasan_kmalloc+0x77/0x90\\n   kvm_set_memory_region.part.0+0x652/0x1110 [kvm]\\n   kvm_vm_ioctl+0x14b0/0x3290 [kvm]\\n   __x64_sys_ioctl+0x129/0x1a0\\n   do_syscall_64+0x5b/0x900\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\n  Freed by task 745 on cpu 6 at 9.747467s:\\n   kasan_save_stack+0x20/0x40\\n   kasan_save_track+0x13/0x50\\n   __kasan_save_free_info+0x37/0x50\\n   __kasan_slab_free+0x3b/0x60\\n   kfree+0xf5/0x440\\n   kvm_set_memslot+0x3c2/0x1160 [kvm]\\n   kvm_set_memory_region.part.0+0x86a/0x1110 [kvm]\\n   kvm_vm_ioctl+0x14b0/0x3290 [kvm]\\n   __x64_sys_ioctl+0x129/0x1a0\\n   do_syscall_64+0x5b/0x900\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nKVM: No permitir la alternancia de KVM_MEM_GUEST_MEMFD en un memslot existente\\n\\nRechazar los intentos de deshabilitar KVM_MEM_GUEST_MEMFD en un memslot que fue creado inicialmente con una vinculaci\u00f3n guest_memfd, ya que KVM no soporta la alternancia de KVM_MEM_GUEST_MEMFD en memslots existentes. KVM impide habilitar KVM_MEM_GUEST_MEMFD, pero no impide borrar el indicador.\\n\\nLa falta de rechazo del nuevo memslot resulta en un uso despu\u00e9s de liberaci\u00f3n debido a que KVM no se desvincula de la instancia guest_memfd. La desvinculaci\u00f3n en un cambio de FLAGS_ONLY es bastante sencilla, y puede/ser\u00e1 realizada como una medida de endurecimiento (en anticipaci\u00f3n de que KVM soporte el registro de cambios (dirty logging) en guest_memfd en alg\u00fan momento), pero corregir el uso despu\u00e9s de liberaci\u00f3n solo abordar\u00eda el s\u00edntoma inmediato.\\n\\n  ==================================================================\\n  ERROR: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en kvm_gmem_release+0x362/0x400 [kvm]\\n  Escritura de tama\u00f1o 8 en la direcci\u00f3n ffff8881111ae908 por la tarea repro/745\\n\\n  CPU: 7 UID: 1000 PID: 745 Comm: repro No contaminado 6.18.0-rc6-115d5de2eef3-next-kasan #3 NINGUNO\\n  Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\\n  Traza de llamada:\\n   \\n   dump_stack_lvl+0x51/0x60\\n   print_report+0xcb/0x5c0\\n   kasan_report+0xb4/0xe0\\n   kvm_gmem_release+0x362/0x400 [kvm]\\n   __fput+0x2fa/0x9d0\\n   task_work_run+0x12c/0x200\\n   do_exit+0x6ae/0x2100\\n   do_group_exit+0xa8/0x230\\n   __x64_sys_exit_group+0x3a/0x50\\n   x64_sys_call+0x737/0x740\\n   do_syscall_64+0x5b/0x900\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n  RIP: 0033:0x7f581f2eac31\\n   \\n\\n  Asignado por la tarea 745 en la CPU 6 a las 9.746971s:\\n   kasan_save_stack+0x20/0x40\\n   kasan_save_track+0x13/0x50\\n   __kasan_kmalloc+0x77/0x90\\n   kvm_set_memory_region.part.0+0x652/0x1110 [kvm]\\n   kvm_vm_ioctl+0x14b0/0x3290 [kvm]\\n   __x64_sys_ioctl+0x129/0x1a0\\n   do_syscall_64+0x5b/0x900\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\n  Liberado por la tarea 745 en la CPU 6 a las 9.747467s:\\n   kasan_save_stack+0x20/0x40\\n   kasan_save_track+0x13/0x50\\n   __kasan_save_free_info+0x37/0x50\\n   __kasan_slab_free+0x3b/0x60\\n   kfree+0xf5/0x440\\n   kvm_set_memslot+0x3c2/0x1160 [kvm]\\n   kvm_set_memory_region.part.0+0x86a/0x1110 [kvm]\\n   kvm_vm_ioctl+0x14b0/0x3290 [kvm]\\n   __x64_sys_ioctl+0x129/0x1a0\\n   do_syscall_64+0x5b/0x900\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"virt/kvm/kvm_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a7800aa80ea4d5356b8474c2302812e9d4926fa6\",\"lessThan\":\"89dbbe6ff323fc34659621a577fe0af913f47386\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a7800aa80ea4d5356b8474c2302812e9d4926fa6\",\"lessThan\":\"cb51bef465d8ec60a968507330e01020e35dc127\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a7800aa80ea4d5356b8474c2302812e9d4926fa6\",\"lessThan\":\"9935df5333aa503a18de5071f53762b65c783c4c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"virt/kvm/kvm_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/89dbbe6ff323fc34659621a577fe0af913f47386\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9935df5333aa503a18de5071f53762b65c783c4c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cb51bef465d8ec60a968507330e01020e35dc127\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-13T17:35:49+00:00",
      "cve": "CVE-2025-68810",
      "id": "CVE-2025-68810",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: KVM use-after-free due to improper handling of guest memory file descriptor flags",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68810.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:11:45Z",
      "cve": "CVE-2025-68810",
      "id": "CVE-2025-68810",
      "initial_release_date": "2026-01-15T00:25:49Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "459",
      "product_status:known_not_affected": "312",
      "product_status:recommended": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68810",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68810.json",
      "version": "28"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.