CVE-2025-68266: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68266 is a Linux kernel vulnerability in the BFS (Boot File System) filesystem driver where corrupted on-disk inode data can cause bogus S_IFMT bits to be set in inode->i_mode. The flaw arises because the BFS driver does not properly validate or reconstruct the file type when loading inode metadata from disk — specifically, the upper 23 bits of the 32-bit mode field (including S_IFMT) and the attributes field are not sanitized. It was first published on December 16, 2025, and affects the Linux kernel across a broad range of stable versions. The EPSS score is approximately 0.017% (very low), and no CVSS score has been formally assigned by NVD at this time (Feedly, CVE Record).

The root cause is improper input validation (CWE not formally assigned by NVD) when the BFS filesystem driver reads inode metadata from disk. BFS documentation specifies that only the lower 9 bits of the mode field are used, but the driver previously did not mask off the upper 23 bits — including the S_IFMT file-type bits — before applying them to inode->i_mode. Additionally, the attributes field was not validated to ensure it contained only the two legal values (BFS_VREG for regular files or BFS_VDIR for the root directory). The fix reconstructs the file type from the attributes field rather than trusting the on-disk mode field's upper bits, and adds a validity check on the attributes value. The issue was discovered via syzbot, Google's kernel fuzzing infrastructure (Feedly, CVE Record).

Exploitation of this vulnerability requires a locally mounted, specially crafted or corrupted BFS filesystem image. A malicious or corrupted disk image could cause the kernel to operate on inodes with invalid file-type bits, potentially leading to undefined kernel behavior, system instability, or a kernel panic (denial of service). The confidentiality and integrity impact is considered limited given the local access requirement and the niche use of the BFS filesystem; however, in environments where untrusted filesystem images are mounted (e.g., virtualization or embedded systems), the risk of kernel instability is real (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-68266. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to mount a crafted BFS filesystem image, significantly limiting the attack surface (Feedly).

Patches have been applied to multiple Linux kernel stable branches. Fixed commits include 34ab4c75588c (targeting kernel 6.12.62), 77899444d461 and a8cb796e7e2c (targeting kernel 6.18), 8f73336b75bd and a9f626396bfe, aeccd6743ee4, and d0c5ec1f57d8 (CVE Record). Downstream distributions including Debian (linux 6.1.162-1, 5.10.249-1) and Ubuntu (USN-8096-x, USN-8094-x, USN-8152-1, USN-8179-x, USN-8184-1, USN-8185-x, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1) have issued updated kernel packages (Ubuntu USN-8096-1, Debian Tracker). The recommended remediation is to update to a patched kernel version provided by your distribution. As a workaround, avoid mounting untrusted or potentially corrupted BFS filesystem images.