CVE-2025-68791: fuse: missing copy_finish in fuse-over-io-uring argument copies

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-13 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: fuse: missing copy_finish in fuse-over-io-uring argument copies Fix a possible reference count leak of payload pages during fuse argument copies. [Joanne: simplified error cleanup]

Affected products

Linux kernel: 6.14 — fixed in 6.19

How to fix

Upgrade to a fixed version: Linux kernel 6.19. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/6e0d7f7f4a43ac8868e98c87ecf48805aa8c24dd
https://git.kernel.org/stable/c/b79938863f436960eff209130f025c4bd3026bf8

Get alerted when CVE-2025-68791 or the next vulnerability affects your stack