CVE-2025-68361: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68361 is a kernel stack overflow vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) subsystem, caused by insufficient limits on filesystem stacking depth for file-backed mounts. An attacker or misconfigured system can trigger the issue by mounting EROFS on top of itself (or through deep stacking chains), exhausting kernel stack space. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from commit fb176750266a3d7f42ebdcf28e8ba40350b27847 up to the fixes backported into stable branches. Patches are available in kernel versions 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. No official CVSS score has been assigned; Feedly estimates the severity as Medium, and the EPSS score is 0.018% (Feedly, EUVD).

The root cause is a missing depth check in the EROFS filesystem's file-backed mount path, classified under CWE-674 (Uncontrolled Recursion) or stack exhaustion. When EROFS is mounted using a backing file that itself resides on an EROFS filesystem — or when stacking is otherwise deeply nested — the kernel can recurse through filesystem layers without bound, eventually overflowing the kernel stack. The fix introduces a limit on the level of filesystem stacking permitted for file-backed EROFS mounts, analogous to protections present in other stackable filesystems (e.g., overlayfs). The vulnerability was introduced with commit fb176750266a3d7f42ebdcf28e8ba40350b27847 and corrected in four separate stable-branch commits (EUVD, Kernel Git).

Successful exploitation causes a kernel stack overflow, which can result in a kernel panic (system crash) and denial of service. On systems where a local user has the ability to mount filesystems (e.g., via user namespaces or privileged access), this could be triggered intentionally to crash the host. There is no evidence of confidentiality or integrity impact beyond availability loss; lateral movement or data exfiltration are not primary concerns for this vulnerability (Feedly, EUVD).

Apply the upstream kernel patches that introduce stacking depth limits for EROFS file-backed mounts. Fixed versions include Linux kernel 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. The relevant stable-branch fix commits are 34447aeedbaea8f9aad3da5b07030a1c0e124639, b4911825348a494e894e6ccfcf88d99e9425f129, 620472e6b303c4dbcc7ecf1aba1cda4f3523e4a4, and d53cd891f0e4311889349fff3a784dc552f814b9. As a workaround on systems where EROFS is not required, administrators can prevent loading the erofs kernel module using modprobe.blacklist=erofs or equivalent configuration (EUVD, Kernel Git).