Security readout for executives and security teams
Plain-English summary
A Linux kernel read-range bug can miscalculate how much data to skip when reads are not block-aligned. In the worst described condition, a length underflow returns a position beyond the memory folio. This could cause incorrect reads or instability, but the cited sources do not establish a practical attack chain or observed compromise.
Executive priority
Treat this as urgent kernel patch-validation work because the supplied rating is critical and CVSS is 9.8. Prioritize confirmed affected systems supporting important workloads. However, do not treat it as evidence of compromise: active exploitation is not reported, and the practical attack path remains insufficiently documented.
Technical view
iomap_adjust_read_range() assumed block-aligned positions and lengths. It could skip too many bytes for uptodate blocks because the calculation omitted the block offset. When every block was uptodate, the length could underflow and the returned position could exceed the folio. The referenced kernel commits correct the calculation.
Likely exposure
The record marks Linux versions 4.19, 0, 6.6.120, 6.12.64, 6.18.3, and 6.19 as affected. Treat these as listed entries, not inferred continuous ranges. Distribution package mappings, backport status, required configurations, and broader filesystem exposure are not supplied; EROFS is the only demonstrated case named.
Exploitation context
The bundle reports KEV=false, and no cited source reports active exploitation or a public exploit. The known evidence is a syzbot-generated EROFS case. Attacker prerequisites, remote reachability, and practical confidentiality or integrity impact are not established by the supplied evidence.
Researcher notes
The supplied CVSS vector asserts unauthenticated network reachability and complete confidentiality, integrity, and availability impact. However, the narrative describes a read-range calculation error without substantiating remote reachability or those security consequences. The unusual affected-version list, including version 0, also requires confirmation against kernel and distribution advisories.
Mitigation direction
- Inventory running Linux kernel versions and compare them with the CVE record.
- Check distribution vendor advisories for package-specific fixed versions and backport status.
- Apply vendor-supported kernel updates containing the applicable referenced stable fix.
- Follow vendor mitigation guidance; the supplied sources name no standalone workaround.
Validation and detection
- Confirm the running kernel, not only installed packages, reflects the update.
- Verify package changelogs or source trees contain the applicable referenced commit.
- Run isolated regression tests covering non-block-aligned reads and fully uptodate blocks.
- Recheck CVE and distribution advisories for revised affected-version mappings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68794 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/82b60ffbb532d919959702768dca04c3c0500ae5CVE reference, Linux
- https://git.kernel.org/stable/c/12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3eCVE reference, Linux
- https://git.kernel.org/stable/c/142194fb21afe964d2d194cab1fc357cbf87e899CVE reference, Linux
- https://git.kernel.org/stable/c/7aa6bc3e8766990824f66ca76c19596ce10daf3eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.