CVE-2025-68769: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-68769 is a denial-of-service vulnerability in the Linux kernel's f2fs (Flash-Friendly File System) module caused by improper error handling in the f2fs_recover_fsync_data() function. When an f2fs filesystem is mounted with the ro,norecovery or ro,disable_roll_forward options, the function returns a positive error number that is not properly handled, causing a kernel panic. The vulnerability was published on January 13, 2026, and affects Linux kernel versions including the Microsoft Azure Linux 3 kernel package azl3_kernel_6.6.119.3-3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC).

The root cause is improper error handling (CWE-755) in the f2fs kernel module: f2fs_recover_fsync_data() returns a positive integer (e.g., 1) on certain error conditions instead of a negative error code. This positive value is then passed up to vfs_get_tree(), which interprets it as a success indicator but finds that fc->root was never set, triggering a kernel BUG assertion at fs/super.c:1761. The flaw is exploitable locally by a user who can initiate a mount operation with a specially crafted or previously shut-down f2fs image using the ro,norecovery or ro,disable_roll_forward mount options. Patches are available in the stable kernel tree addressing the return value correction (Microsoft MSRC).

Successful exploitation causes a kernel panic (system crash), resulting in a complete denial of service — the affected system becomes unavailable until rebooted. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems running affected kernel versions that allow unprivileged or user-initiated mount operations are at elevated risk (Microsoft MSRC).

1. Prepare a crafted f2fs image: Create an f2fs filesystem on a block device or image file using mkfs.f2fs -f /dev/vdd, write data, and perform an fsync followed by an f2fs shutdown (f2fs_io shutdown 2 /mnt/f2fs) to leave the filesystem in a state requiring fsync recovery.
2. Unmount the filesystem: Unmount the prepared image (umount /mnt/f2fs) to ensure the recovery data is present.
3. Trigger the vulnerable mount: Attempt to mount the image with recovery-suppressing options: mount -o ro,norecovery /dev/vdd /mnt/f2fs or mount -o ro,disable_roll_forward /dev/vdd /mnt/f2fs.
4. Kernel panic occurs: The f2fs_recover_fsync_data() function returns a positive value (1) instead of a negative error code; this propagates to vfs_get_tree(), which triggers a kernel BUG at fs/super.c:1761, crashing the system (Microsoft MSRC).

• Logs: Kernel log entries containing F2FS-fs: f2fs_recover_fsync_data: recovery fsync data followed by Filesystem f2fs get_tree() didn't set fc->root, returned 1 and kernel BUG at fs/super.c:1761.
• Logs: Kernel oops/panic trace referencing vfs_get_tree.cold, fc_mount, path_mount, and __x64_sys_mount in the call stack.
• Logs: Presence of F2FS-fs: Stopped filesystem due to reason: 0 immediately before the panic, indicating an f2fs shutdown was performed prior to the mount attempt.

Update the Linux kernel to a patched version that includes the fix for f2fs_recover_fsync_data() error handling. For Microsoft Azure Linux 3, upgrade beyond azl3_kernel_6.6.119.3-3. Debian users should apply the fixes included in linux 6.1.162-1 (oldstable) and linux 5.10.249-1 (oldoldstable). Ubuntu users should apply the patches provided in USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, and subsequent updates. As a workaround, restrict filesystem mount permissions to trusted administrators only and avoid mounting untrusted f2fs images with norecovery or disable_roll_forward options (Microsoft MSRC, Debian LTS, Ubuntu USN-8177-1).