CVE-2025-68234

The Ol' Switcheroo: How a Typos in io_uring Nuked Kernel Queues

Alon Barad
Alon Barad
Software Engineer

Jan 15, 2026·5 min read·0 visits

Executive Summary (TL;DR)

In io_uring network commands, a call to skb_queue_splice() had its arguments transposed. This caused the permanent socket error queue to be moved into a temporary on-stack list that gets destroyed when the function returns. The result is data loss, state corruption, and a high probability of a kernel crash (DoS) triggered by a local user.

A classic logic error in the Linux kernel's io_uring subsystem where a developer confused the source and destination arguments in a list-splicing function. Instead of saving temporary data to the socket queue, the kernel accidentally emptied the socket's critical error queue into a temporary variable destined for oblivion.

Official Patches

Fix Analysis (2)

Technical Appendix

CVSS Score
6.2/ 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS Probability
0.02%
Top 94% most exploited

Affected Systems

Linux Kernel 6.17Linux Kernel 6.17.1Linux Kernel 6.17.2Linux Kernel 6.17.3Linux Kernel 6.17.4Linux Kernel 6.17.5Linux Kernel 6.17.6Linux Kernel 6.17.7Linux Kernel 6.17.8Linux Kernel 6.17.9Linux Kernel 6.17.10

Affected Versions Detail

Product
Affected Versions
Fixed Version
Linux Kernel
Linux
>= 6.17, < 6.17.116.17.11
AttributeDetail
Attack VectorLocal
CVSS v3.16.2 (Medium)
ImpactDenial of Service (System Crash)
Vulnerability TypeLogic Error (Argument Transposition)
Affected Subsystemio_uring / net
EPSS Score0.00024
CWE-683
Function Call with Incorrect Order of Arguments

The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to incorrect behavior or security vulnerabilities.

Vulnerability Timeline

Patch Committed to Mainline
2025-12-16
CVE Published
2025-12-16
Backported to Stable
2025-12-18