{"id":"CVE-2025-68810","summary":"KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot\n\nReject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was\ninitially created with a guest_memfd binding, as KVM doesn't support\ntoggling KVM_MEM_GUEST_MEMFD on existing memslots.  KVM prevents enabling\nKVM_MEM_GUEST_MEMFD, but doesn't prevent clearing the flag.\n\nFailure to reject the new memslot results in a use-after-free due to KVM\nnot unbinding from the guest_memfd instance.  Unbinding on a FLAGS_ONLY\nchange is easy enough, and can/will be done as a hardening measure (in\nanticipation of KVM supporting dirty logging on guest_memfd at some point),\nbut fixing the use-after-free would only address the immediate symptom.\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x362/0x400 [kvm]\n  Write of size 8 at addr ffff8881111ae908 by task repro/745\n\n  CPU: 7 UID: 1000 PID: 745 Comm: repro Not tainted 6.18.0-rc6-115d5de2eef3-next-kasan #3 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x51/0x60\n   print_report+0xcb/0x5c0\n   kasan_report+0xb4/0xe0\n   kvm_gmem_release+0x362/0x400 [kvm]\n   __fput+0x2fa/0x9d0\n   task_work_run+0x12c/0x200\n   do_exit+0x6ae/0x2100\n   do_group_exit+0xa8/0x230\n   __x64_sys_exit_group+0x3a/0x50\n   x64_sys_call+0x737/0x740\n   do_syscall_64+0x5b/0x900\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f581f2eac31\n   \u003c/TASK\u003e\n\n  Allocated by task 745 on cpu 6 at 9.746971s:\n   kasan_save_stack+0x20/0x40\n   kasan_save_track+0x13/0x50\n   __kasan_kmalloc+0x77/0x90\n   kvm_set_memory_region.part.0+0x652/0x1110 [kvm]\n   kvm_vm_ioctl+0x14b0/0x3290 [kvm]\n   __x64_sys_ioctl+0x129/0x1a0\n   do_syscall_64+0x5b/0x900\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n  Freed by task 745 on cpu 6 at 9.747467s:\n   kasan_save_stack+0x20/0x40\n   kasan_save_track+0x13/0x50\n   __kasan_save_free_info+0x37/0x50\n   __kasan_slab_free+0x3b/0x60\n   kfree+0xf5/0x440\n   kvm_set_memslot+0x3c2/0x1160 [kvm]\n   kvm_set_memory_region.part.0+0x86a/0x1110 [kvm]\n   kvm_vm_ioctl+0x14b0/0x3290 [kvm]\n   __x64_sys_ioctl+0x129/0x1a0\n   do_syscall_64+0x5b/0x900\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53","modified":"2026-04-02T17:29:38.518455Z","published":"2026-01-13T15:29:16.475Z","related":["SUSE-SU-2026:0962-1","SUSE-SU-2026:1081-1","SUSE-SU-2026:20667-1","SUSE-SU-2026:20720-1","SUSE-SU-2026:20838-1","SUSE-SU-2026:20845-1","SUSE-SU-2026:20876-1","SUSE-SU-2026:20931-1","openSUSE-SU-2026:20416-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68810.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/89dbbe6ff323fc34659621a577fe0af913f47386"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9935df5333aa503a18de5071f53762b65c783c4c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cb51bef465d8ec60a968507330e01020e35dc127"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68810.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68810"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a7800aa80ea4d5356b8474c2302812e9d4926fa6"},{"fixed":"89dbbe6ff323fc34659621a577fe0af913f47386"},{"fixed":"cb51bef465d8ec60a968507330e01020e35dc127"},{"fixed":"9935df5333aa503a18de5071f53762b65c783c4c"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68810.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.12.64"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.3"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68810.json"}}],"schema_version":"1.7.5"}