---
cve: "CVE-2025-68794"
severity: "CRITICAL"
cvss: 9.8
epss: "0.7%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-01-13 16:16:01"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-27T20:03:30+01:00"
---

# CVE-2025-68794

> 9.8 CRITICAL

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

iomap: adjust read range correctly for non-block-aligned positions

iomap_adjust_read_range() assumes that the position and length passed in
are block-aligned. This is not always the case however, as shown in the
syzbot generated case for erofs. This causes too many bytes to be
skipped for uptodate blocks, which results in returning the incorrect
position and length to read in. If all the blocks are uptodate, this
underflows length and returns a position beyond the folio.

Fix the calculation to also take into account the block offset when
calculating how many bytes can be skipped for uptodate blocks.

## CNA-Record (Kanon, cvelistV5)

- CNA: **Linux**
- State: PUBLISHED
- Stand: 2026-10-19 18:05:07
- CNA-CVSS: **9.8** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-190** — Integer Overflow or Wraparound
  The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

## Angriffsmuster (CAPEC)

- [CAPEC-92 — Forced Integer Overflow](https://capec.mitre.org/data/definitions/92.html) _(Severity: High)_

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.267
- Kernel ≥ 5.15.218
- Kernel ≥ 6.1.185
- Kernel ≥ 6.6.120
- Kernel ≥ 6.12.64
- Kernel ≥ 6.18.3

## BSI-Hinweise (deutsch)

- [Linux Kernel: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-0086) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.

## Referenzen

- <https://git.kernel.org/stable/c/ce20f49ac9194cf81a77f01d1c316d7c17ae753c>
- <https://git.kernel.org/stable/c/275b37a1e5c2c8abd313e8075f6aec9a349f291b>
- <https://git.kernel.org/stable/c/b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac>
- <https://git.kernel.org/stable/c/82b60ffbb532d919959702768dca04c3c0500ae5>
- <https://git.kernel.org/stable/c/12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e>
- <https://git.kernel.org/stable/c/142194fb21afe964d2d194cab1fc357cbf87e899>
- <https://git.kernel.org/stable/c/7aa6bc3e8766990824f66ca76c19596ce10daf3e>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-68794/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_