Missing Release of Resource after Effective Lifetime The advisory has been revoked - it doesn't affect any version of package libperf (opens in a new tab)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL10-LIBPERF-14451510
- published17 Dec 2025
- disclosed16 Dec 2025
Introduced: 16 Dec 2025
CVE-2025-68219 (opens in a new tab)Amendment
The Red Hat security team deemed this advisory irrelevant for RHEL:10.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libperf package and not the libperf package as distributed by RHEL.
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix memory leak in smb3_fs_context_parse_param error path
Add proper cleanup of ctx->source and fc->source to the cifs_parse_mount_err error handler. This ensures that memory allocated for the source strings is correctly freed on all error paths, matching the cleanup already performed in the success path by smb3_cleanup_fs_context_contents(). Pointers are also set to NULL after freeing to prevent potential double-free issues.
This change fixes a memory leak originally detected by syzbot. The leak occurred when processing Opt_source mount options if an error happened after ctx->source and fc->source were successfully allocated but before the function completed.
The specific leak sequence was:
- ctx->source = smb3_fs_context_fullpath(ctx, '/') allocates memory
- fc->source = kstrdup(ctx->source, GFP_KERNEL) allocates more memory
- A subsequent error jumps to cifs_parse_mount_err
- The old error handler freed passwords but not the source strings, causing the memory to leak.
This issue was not addressed by commit e8c73eb7db0a ("cifs: client: fix memory leak in smb3_fs_context_parse_param"), which only fixed leaks from repeated fsconfig() calls but not this error path.
Patch updated with minor change suggested by kernel test robot
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2422709
- https://access.redhat.com/security/cve/CVE-2025-68219
- https://git.kernel.org/stable/c/37010021d7e0341bb241ca00bcbae31f2c50b23f
- https://git.kernel.org/stable/c/48d69290270891f988e72edddd9688c20515421d
- https://git.kernel.org/stable/c/7627864dc3121f39e220f5253a227edf472de59e
- https://git.kernel.org/stable/c/7e4d9120cfa413dd34f4f434befc5dbe6c38b2e5
- https://git.kernel.org/stable/c/a8071fd69df335362be5ecf5df5a167fd1eb5853