CVE-2025-68351: exfat: fix refcount leak in exfat_find

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-24 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: exfat: fix refcount leak in exfat_find Fix refcount leaks in `exfat_find` related to `exfat_get_dentry_set`. Function `exfat_get_dentry_set` would increase the reference counter of `es->bh` on success. Therefore, `exfat_put_dentry_set` must be called after `exfat_get_dentry_set` to ensure refcount consistency. This patch relocate two checks to avoid possible leaks.

Affected products

Linux kernel: from 6.12.23 before 6.12.68; from 6.12.59 before 6.13; from 6.13.11 before 6.14; from 6.14.1 before 6.18.2; 6.14, 6.14-rc6, 6.14-rc7 — fixed in 6.12.68, 6.13, 6.14, 6.18.2

How to fix

Upgrade to a fixed version: Linux kernel 6.12.68, 6.13, 6.14, 6.18.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-68351 or the next vulnerability affects your stack