CVE-2025-68778: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68778 is a filesystem corruption vulnerability in the Linux kernel's btrfs (B-tree filesystem) implementation, caused by improper logging of conflicting inodes during directory move operations within the same transaction. When a directory is moved to a new parent and a file is subsequently created with the directory's original name — followed by specific rename and fsync operations — the log replay mechanism can create a directory inode with two hard links, corrupting the filesystem state. The vulnerability was published on January 13, 2026, and affects the Linux kernel broadly, with Microsoft specifically identifying the Azure Linux 3 kernel version azl3_kernel_6.6.119.3-3 as affected. It carries a CVSS v3.1 base score of 6.1 (Medium) (Feedly, Microsoft MSRC).

The root cause is improper state management in the btrfs inode logging subsystem (related to CWE-667: Improper Locking / incorrect state handling). When btrfs_log_new_name() is called during a rename, it updates the log tree with the new INODE_REF for a moved directory but does not correctly prevent logging of a conflicting inode that was moved in the current transaction. The specific trigger sequence is: (1) a directory exists with a prior-transaction parent; (2) the directory is moved to a new parent in the current transaction; (3) a new file is created with the moved directory's old name; (4) the new file is fsynced, causing the moved directory's inode to be logged; (5) the new file is renamed and fsynced again, persisting the log tree state. During log replay after a crash, the kernel attempts to reconstruct both the old and new parent references for the directory inode, resulting in a directory with two hard links — an invalid state for btrfs. Patches are referenced in the Linux kernel stable tree (Feedly).

Successful triggering of this vulnerability results in filesystem corruption that is detected during extent buffer writeback, producing the kernel error message corrupt leaf: invalid nlink: has 2 expect no more than 1 for dir. This causes a complete mount failure of the affected btrfs filesystem after a crash or power failure, rendering all data on the filesystem inaccessible until manual recovery is performed. The primary impact is a high availability loss; confidentiality is not affected, and integrity impact is limited to the corrupted filesystem metadata. Systems relying on btrfs for critical data storage — particularly those running Azure Linux 3 — face data unavailability risk following unexpected shutdowns (Feedly).

Apply the available kernel patch, which has been resolved in the Linux kernel stable tree and is available through Microsoft updates for Azure Linux 3 (fixing kernel version azl3_kernel_6.6.119.3-3). Debian, Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), SUSE, and Red Hat have also issued kernel updates addressing this CVE. As an interim workaround, avoid performing the specific sequence of directory moves followed by same-name file creation and subsequent renames within a single transaction on btrfs filesystems. Implementing robust backup and disaster recovery procedures is strongly recommended to mitigate the impact of potential filesystem corruption until patching is complete (Feedly, Microsoft MSRC, Ubuntu USN-8177-1).