LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68821: fuse: fix readahead reclaim deadlock

In the Linux kernel, the following vulnerability has been resolved: fuse: fix readahead reclaim deadlock Commit e26ee4efbc79 ("fuse: allocate ff->release_args only if release is needed") skips allocating ff->release_args if the server does not implement open. However in doing so, fuse_prepare_release() now skips grabbing the reference on the inode, which makes it possible for an inode to be evicted from the dcache while there are inflight readahead requests. This causes a deadlock if the server triggers reclaim while servicing the readahead request and reclaim attempts to evict the inode of the file being read ahead. Since the folio is locked during readahead, when reclaim evicts the fuse inode and fuse_evict_inode() attempts to remove all folios associated with the inode from the page cache (truncate_inode_pages_range()), reclaim will block forever waiting for the lock since readahead cannot relinquish the lock because it is itself blocked in reclaim: >>> stack_trace(1504735) folio_wait_bit_common (mm/filemap.c:1308:4) folio_lock (./include/linux/pagemap.h:1052:3) truncate_inode_pages_range (mm/truncate.c:336:10) fuse_evict_inode (fs/fuse/inode.c:161:2) evict (fs/inode.c:704:3) dentry_unlink_inode (fs/dcache.c:412:3) __dentry_kill (fs/dcache.c:615:3) shrink_kill (fs/dcache.c:1060:12) shrink_dentry_list (fs/dcache.c:1087:3) prune_dcache_sb (fs/dcache.c:1168:2) super_cache_scan (fs/super.c:221:10) do_shrink_slab (mm/shrinker.c:435:9) shrink_slab (mm/shrinker.c:626:10) shrink_node (mm/vmscan.c:5951:2) shrink_zones (mm/vmscan.c:6195:3) do_try_to_free_pages (mm/vmscan.c:6257:3) do_swap_page (mm/memory.c:4136:11) handle_pte_fault (mm/memory.c:5562:10) handle_mm_fault (mm/memory.c:5870:9) do_user_addr_fault (arch/x86/mm/fault.c:1338:10) handle_page_fault (arch/x86/mm/fault.c:1481:3) exc_page_fault (arch/x86/mm/fault.c:1539:2) asm_exc_page_fault+0x22/0x27 Fix this deadlock by allocating ff->release_args and grabbing the reference on the inode when preparing the file for release even if the server does not implement open. The inode reference will be dropped when the last reference on the fuse file is dropped (see fuse_file_put() -> fuse_release_end()).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-68821 is a Linux kernel FUSE availability bug. A file read-ahead path can deadlock during memory reclaim when inode references are not held correctly. The public record describes a resolved kernel flaw, but provides no CVSS score and no evidence of active exploitation.

Executive priority

Handle through standard kernel patching, with elevated priority for production systems that depend on FUSE-backed storage. The business risk is service unavailability from kernel deadlock, not confirmed data theft or active exploitation based on the supplied sources.

Technical view

The issue is in Linux kernel FUSE release handling after commit e26ee4efbc79. If a FUSE server does not implement open, release_args and an inode reference may be skipped. In-flight readahead can then collide with reclaim-driven inode eviction, causing truncate_inode_pages_range to wait indefinitely on a locked folio.

Likely exposure

Exposure is most likely on Linux systems using FUSE filesystems, especially user-space FUSE servers without open support and workloads that trigger readahead and memory reclaim. Distro backports may change version-based exposure, so kernel package advisories matter more than upstream version strings alone.

Exploitation context

The sources describe a deadlock condition and kernel fix. They do not state remote exploitability, privilege requirements, public exploit availability, or active exploitation. KEV status is false, so treat this as an availability risk requiring normal kernel vulnerability management unless local environment evidence raises priority.

Researcher notes

The root cause and fix direction are clear from the kernel description: preserve release_args allocation and inode reference handling even without server open support. Missing evidence includes CVSS, attacker model, reproducibility constraints, and downstream package status.

Mitigation direction

  • Apply vendor kernel updates that include the referenced FUSE fix.
  • Prioritize hosts running critical FUSE-backed workloads or memory-pressure-sensitive services.
  • Review distribution advisories for backported fixed kernel package versions.
  • Consider reducing reliance on vulnerable FUSE paths until patched where uptime is critical.

Validation and detection

  • Inventory Linux kernel versions and distro package build identifiers.
  • Identify systems using FUSE filesystems in production workloads.
  • Map installed kernels to vendor advisories or referenced stable commits.
  • Check incident data for unexplained FUSE hangs under memory pressure.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68821 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa39f70d63f4373a598820d9491719e44cd60afe9, 7d38aa079ed859b73f4460aab89c7619b04963b8, c7ec75f3cbf73bd46f479f7d6942585f765715da, e26ee4efbc79610b20e7abe9d96c87f33dacc1ff, e26ee4efbc79610b20e7abe9d96c87f33dacc1ff, e26ee4efbc79610b20e7abe9d96c87f33dacc1ff, 5.15.196, 6.1.158, 6.6.115unaffected
LinuxLinux6.9, 0, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.