CVE-2025-68251: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68251 is a vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) subsystem that can cause an infinite loop when processing corrupted subpage compact indexes. The root cause is that clusterofs can be larger than lclustersize for non-NONHEAD lclusters in corrupted subpage compact indexes (e.g., blocksize = lclustersize = 512, lcn = 6, clusterofs = 515). The issue was reported by a researcher named Robert via two crafted filesystem images and was published on December 16, 2025. No official CVSS score has been assigned by NVD (status: "Not Scheduled" for enrichment), though Feedly estimates it as Medium severity with an EPSS score of 0.000180 (CVE Record, ENISA EUVD).

The vulnerability resides in the z_erofs_load_lcluster_from_disk() function within the Linux kernel's EROFS compressed filesystem driver. The flaw is a missing or misplaced input validation check: the boundary check for clusterofs versus lclustersize was only applied to full compress indexes, not to subpage compact compress indexes, allowing a crafted filesystem image to supply an out-of-bounds clusterofs value that causes the kernel to enter an infinite loop. The fix moves the validation check into z_erofs_load_lcluster_from_disk() to cover both full and subpage compact compress index paths, and also corrects the placement of the m->type >= Z_EROFS_LCLUSTER_TYPE_MAX check to occur immediately after z_erofs_load_{compact,full}_lcluster(). This is a local, filesystem-triggered vulnerability requiring the ability to mount or present a malicious EROFS image to the kernel (CVE Record, ENISA EUVD).

Successful exploitation causes the Linux kernel to enter an infinite loop when mounting or processing a specially crafted EROFS filesystem image with corrupted subpage compact indexes, resulting in a denial of service (system hang or unresponsive kernel thread). The primary impact is on availability; there is no evidence of confidentiality or integrity compromise. Systems that automatically mount user-supplied or untrusted EROFS images (e.g., container runtimes, embedded systems, or removable media handlers) are most at risk (CVE Record, ENISA EUVD).

The fix has been applied to the Linux kernel stable tree via commits 8675447a8794983f2b7e694b378112772c17635e, e13d315ae077bb7c3c6027cc292401bc0f4ec683, and dbfac1b85d0753996ddfef636934d431b588dd1f. Patched versions include kernel 6.17.6 and 6.18 per ENISA EUVD data. Administrators should update to a patched kernel version as soon as available from their distribution. As a workaround, avoid mounting untrusted or user-supplied EROFS filesystem images on unpatched systems, and restrict access to filesystem mounting capabilities where possible (ENISA EUVD, Kernel Patch 1, Kernel Patch 2).