CVE-2025-68772: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68772 is a race condition vulnerability in the Linux kernel's f2fs (Flash-Friendly File System) compression handling that can cause a divide-by-zero kernel oops, resulting in a denial of service. The flaw was reported by Bai, Shuangpeng and published on January 13, 2026. It affects Linux kernel versions with f2fs compression support, including Microsoft Azure Linux 3 (azl3_kernel 6.6.119.3-3 and earlier), as well as various Debian and Ubuntu kernel packages. It carries a CVSS v3.1 base score of 5.0 (Medium) (Feedly, Microsoft MSRC).

The root cause is a race condition (CWE-362) in the f2fs filesystem's compression context management. When one thread performs writeback via f2fs_write_cache_pages on a non-compressed file, a concurrent thread can invoke setattr or ioctl to update the inode's compression cluster size from 0 to 4 mid-operation. This causes f2fs_all_cluster_page_ready (at fs/f2fs/compress.c:857) to attempt a modulo operation (pgidx % cc->cluster_size) with a cluster size of 0, triggering a divide-by-zero kernel oops. The fix introduces an atomic writeback counter in f2fs_inode_info, protected by i_sem, and adds a guard in f2fs_setflags_common to block compression context updates while writeback is in progress (Feedly).

Successful exploitation causes a kernel oops (divide error) that crashes the affected system, resulting in a complete denial of service with high availability impact. There is no confidentiality or integrity impact — the vulnerability cannot be used to access or modify data. The crash affects the entire system, not just the f2fs subsystem, meaning all services on the host are disrupted (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires low privileges (local access with file permissions) and user interaction to trigger the precise race condition involving concurrent fsync, setattr, and ioctl operations. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing divide error: 0000 [#1] and references to f2fs_all_cluster_page_ready+0x106/0x550 fs/f2fs/compress.c:857.
• Logs: Stack traces referencing f2fs_write_cache_pages, __f2fs_write_data_pages, f2fs_write_data_pages, and f2fs_do_sync_file in kernel crash logs.
• Process: Unusual concurrent activity from processes performing fsync, setattr (e.g., chattr), and ioctl on the same f2fs-mounted file simultaneously.
• System: Unexpected system reboots or kernel panics on hosts using f2fs-formatted storage with compression enabled.

Apply the upstream Linux kernel patch that introduces the atomic writeback variable in f2fs_inode_info and guards compression context updates in f2fs_setflags_common. Patches are available via the Linux stable kernel tree (commits 0bf1a02494c7, 0df713a9c082, 10b591e7fb7c, ad26bfbc085c). Distributions including Debian (DSA-6126-1, DLA-4476-1), Ubuntu (USN-8177-1/2, USN-8179-1/2/3/4, USN-8183-1/2, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), and Microsoft Azure Linux 3 have released updated kernel packages. As a workaround where patching is not immediately possible, avoid enabling f2fs compression on inodes that are subject to concurrent writeback and attribute modification (Feedly, Debian LTS, Ubuntu USN-8177-1).