cbcvebase.
CVE-2025-68821
published 2026-01-13

CVE-2025-68821: In the Linux kernel, the following vulnerability has been resolved: fuse: fix readahead reclaim deadlock Commit e26ee4efbc79 ("fuse: allocate ff->release_args…

PriorityP422medium6.4
EPSS
0.17%
6.9th percentile
In the Linux kernel, the following vulnerability has been resolved: fuse: fix readahead reclaim deadlock Commit e26ee4efbc79 ("fuse: allocate ff->release_args only if release is needed") skips allocating ff->release_args if the server does not implement open. However in doing so, fuse_prepare_release() now skips grabbing the reference on the inode, which makes it possible for an inode to be evicted from the dcache while there are inflight readahead requests. This causes a deadlock if the server triggers reclaim while servicing the readahead request and reclaim attempts to evict the inode of the file being read ahead. Since the folio is locked during readahead, when reclaim evicts the fuse inode and fuse_evict_inode() attempts to remove all folios associated with the inode from the page cache (truncate_inode_pages_range()), reclaim will block forever waiting for the lock since readahead cannot relinquish the lock because it is itself blocked in reclaim: >>> stack_trace(1504735) folio_wait_bit_common (mm/filemap.c:1308:4) folio_lock (./include/linux/pagemap.h:1052:3) truncate_inode_pages_range (mm/truncate.c:336:10) fuse_evict_inode (fs/fuse/inode.c:161:2) evict (fs/inode.c:704:3) dentry_unlink_inode (fs/dcache.c:412:3) __dentry_kill (fs/dcache.c:615:3) shrink_kill (fs/dcache.c:1060:12) shrink_dentry_list (fs/dcache.c:1087:3) prune_dcache_sb (fs/dcache.c:1168:2) super_cache_scan (fs/super.c:221:10) do_shrink_slab (mm/shrinker.c:435:9) shrink_slab (mm/shrinker.c:626:10) shrink_node (mm/vmscan.c:5951:2) shrink_zones (mm/vmscan.c:6195:3) do_try_to_free_pages (mm/vmscan.c:6257:3) do_swap_page (mm/memory.c:4136:11) handle_pte_fault (mm/memory.c:5562:10) handle_mm_fault (mm/memory.c:5870:9) do_user_addr_fault (arch/x86/mm/fault.c:1338:10) handle_page_fault (arch/x86/mm/fault.c:1481:3) exc_page_fault (arch/x86/mm/fault.c:1539:2) asm_exc_page_fault+0x22/0x27 Fix this deadlock by allocating ff->release_args and grabbing the reference on the inode when preparing the file fo

Affected

49 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
debianlinux-6.1< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
linuxlinux
linuxlinux>= 5.15.196 < 5.15.1985.15.198
linuxlinux>= 6.1.158 < 6.1.1606.1.160
linuxlinux>= 6.6.115 < 6.6.1206.6.120
linuxlinux>= 7d38aa079ed859b73f4460aab89c7619b04963b8 < 4703bc0e8cd3409acb1476a70cb5b7ff943cf39a4703bc0e8cd3409acb1476a70cb5b7ff943cf39a
linuxlinux>= a39f70d63f4373a598820d9491719e44cd60afe9 < cbbf3f1bb9f834bb2acbb61ddca74363456e19cdcbbf3f1bb9f834bb2acbb61ddca74363456e19cd
linuxlinux>= c7ec75f3cbf73bd46f479f7d6942585f765715da < cf74785c00b8b1c0c4a9dd74bfa9c22d62e2d99fcf74785c00b8b1c0c4a9dd74bfa9c22d62e2d99f
linuxlinux>= e26ee4efbc79610b20e7abe9d96c87f33dacc1ff < fbba8b00bbe4e4f958a2b0654cc1219a7e6597f6fbba8b00bbe4e4f958a2b0654cc1219a7e6597f6
linuxlinux>= e26ee4efbc79610b20e7abe9d96c87f33dacc1ff < e0d6de83a4cc22bbac72713f3a58121af36cc411e0d6de83a4cc22bbac72713f3a58121af36cc411
linuxlinux>= e26ee4efbc79610b20e7abe9d96c87f33dacc1ff < bd5603eaae0aabf527bfb3ce1bb07e979ce5bd50bd5603eaae0aabf527bfb3ce1bb07e979ce5bd50
linuxlinux_kernel>= 0 < 6.1.162-16.1.162-1
linuxlinux_kernel>= 0 < 6.12.69-16.12.69-1
linuxlinux_kernel>= 0 < 6.18.3-16.18.3-1
linuxlinux_kernel>= 0 < 5.15.1985.15.198
linuxlinux_kernel>= 0 < 5.15.0-173.1835.15.0-173.183
linuxlinux_kernel>= 5.16.0 < 6.1.1606.1.160
linuxlinux_kernel>= 6.2.0 < 6.6.1206.6.120
linuxlinux_kernel>= 6.7.0 < 6.12.646.12.64
linuxlinux_kernel>= 6.9.0 < 6.18.36.18.3
ubuntulinux-aws
ubuntulinux-aws-6.17
ubuntulinux-aws-fips
ubuntulinux-azure

CVSS provenance

vendor_ubuntu6.4MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.