CVE-2025-68297: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68297 is a vulnerability in the Linux kernel's Ceph filesystem client that causes a kernel crash in the process_v2_sparse_read() function when handling fscrypt-encrypted directories over the Ceph msgr2 protocol in secure mode. The issue was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. It is estimated as Medium severity with an EPSS score of 0.000180 (Feedly, CVE.org).

The root cause is improper handling of sparse read operations in the Ceph v2 messenger (net/ceph/messenger_v2.c) when the target directory is encrypted with fscrypt. When a client mounts CephFS using ms_mode=secure (msgr2 secure mode), encrypts a directory with fscrypt, locks and unlocks it, and then reads a file, the kernel triggers a WARNING/crash at messenger_v2.c:865 inside ceph_con_v2_try_read(). The vulnerability is classified under improper state or condition handling (CWE not formally assigned, but relates to incorrect buffer/state management during encrypted sparse reads). The bug is reproducible with a specific sequence: mount CephFS in secure mode, create and encrypt a directory with fscrypt, lock/unlock it, and read a file from it (Feedly).

Successful triggering of this vulnerability causes a kernel WARNING and crash (denial of service) on the affected Linux system. The impact is primarily an availability issue — a local or remote user with access to a CephFS mount in secure mode and the ability to use fscrypt-encrypted directories can crash the kernel. There is no evidence of confidentiality or integrity impact beyond the system crash (Feedly).

The Linux kernel maintainers have released fixes across multiple stable branches, with patch commits available in the kernel stable tree (e.g., commits 5a3f3e39b187, 7d1b7de853f7, 43962db4a6f5, 47144748fbf1). Downstream distributions including Ubuntu (USN-8094-1 through USN-8094-5, USN-8152-1) and SUSE have released updated kernel packages incorporating the fix. Administrators should update to the latest patched kernel version provided by their distribution. As a workaround, avoiding the combination of CephFS ms_mode=secure with fscrypt-encrypted directories will prevent triggering the crash (Ubuntu Advisory, Feedly).