Junglewise Threat Intelligence

CVE-2025-68814: Linux Kernel memory leak in io_uring __io_openat_prep

CVE-2025-68814 · Severity: info · CVSS 0 · Published 2026-01-13

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A memory leak vulnerability was identified in the Linux kernel's io_uring subsystem, which is used for high-performance asynchronous I/O operations. Under specific conditions when opening files, the system fails to release memory allocated for filenames, potentially allowing a local attacker to exhaust system memory over time. This could lead to system instability or a denial-of-service condition affecting all hosted applications and services.

Technical details

A memory leak exists in io_uring/openclose.c (or io_uring/io_uring.c in older versions) within the __io_openat_prep() function. The function allocates a 'struct filename' using getname(), but if the request specifies both a fixed file slot and the O_CLOEXEC flag, the function returns an error (-EINVAL) before the REQ_F_NEED_CLEANUP flag is set. Consequently, the allocated memory is not freed during request teardown. The fix involves moving the assignment of the REQ_F_NEED_CLEANUP flag to immediately follow the successful getname() call. Patches are available in various stable kernel branches.

Affected products

  • Linux Linux 5.15 to 5.15.198, 6.1 to 6.1.160, 6.6 to 6.6.80, 6.12 to 6.12.10, 6.13 to 6.13.1
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2025-12-25: other: Patch authored
  • 2026-01-13: advisory: CVE published

References

Related threats