CVE-2025-68240: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68240 is a use-after-free / active-object-free vulnerability in the Linux kernel's nilfs2 filesystem driver, specifically in the segment constructor (segctor) subsystem. The flaw arises when kthread_stop() fails to properly stop sc_task and returns -EINTR, leaving the sc_timer (a timer_list object) active at the time sci (the segment constructor info structure) is freed. This was discovered and reported by syzbot and disclosed on December 16, 2025. Affected versions span Linux kernel commits from 3f66cc261ccb54a8e4d8d5aa51c389c19453b00c up to the respective fix commits; patched versions include Linux 6.12.59, 6.17.9, and 6.18. No CVSS score has been assigned by NVD at this time; the EPSS score is approximately 0.017% (Feedly, CVE.org).

The root cause is improper lifecycle management of a kernel timer object (CWE not formally assigned by NVD). In nilfs_segctor_destroy(), when kthread_stop() returns a non-zero value (e.g., -EINTR), the code incorrectly assumes the segctor thread has not properly shut down sc_timer. As a result, sc_timer remains active when sci is freed, triggering an ODEBUG warning: free active (active state 0) object of type timer_list with hint nilfs_construction_timeout. The fix introduces timer_shutdown_sync() to synchronously wait for sc_timer to complete shutdown, and sets sc_task to NULL under the protection of sc_state_lock to prevent race conditions. The vulnerable call path is: nilfs_segctor_destroy() → nilfs_detach_log_writer() → nilfs_put_super() (Feedly, CVE.org).

Exploitation of this vulnerability could cause a kernel crash or undefined behavior due to freeing an active timer object, resulting in a denial of service (system crash/panic) on affected Linux systems using the nilfs2 filesystem. Because the bug occurs in kernel space during filesystem unmount operations, it primarily affects availability; there is no direct evidence of confidentiality or integrity impact. Systems that mount nilfs2 filesystems and encounter interrupted kthread operations (e.g., during unmount under load or signal delivery) are at risk (Feedly, CVE.org).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution for CVE-2025-68240. The vulnerability was identified through automated kernel fuzzing by syzbot, indicating it requires specific kernel execution conditions (nilfs2 filesystem in use, kthread interrupted during unmount) rather than a straightforward attack surface. The EPSS score is approximately 0.017%, reflecting very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing ODEBUG: free active (active state 0) object with object type: timer_list and hint: nilfs_construction_timeout.
• Logs: Kernel call trace referencing nilfs_segctor_destroy, nilfs_detach_log_writer, or nilfs_put_super during filesystem unmount.
• System Behavior: Unexpected kernel panic or system crash occurring during unmounting of a nilfs2 filesystem, particularly under load or when signals interrupt kernel threads.

Apply the upstream kernel patches that introduce timer_shutdown_sync() in the nilfs2 segctor teardown path. Fixed versions are available in Linux kernel stable releases 6.12.59, 6.17.9, and 6.18, corresponding to commits 36049e81dc7f, 2f65799e2a73, and 9a6b60cb147d respectively. As a workaround, avoid using nilfs2 filesystems on affected kernel versions, or ensure systems are not subjected to conditions that interrupt kthread operations during unmount. Users should update to a patched kernel version as soon as possible (Feedly, CVE.org).