CVE-2025-68796: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-68796 is a denial-of-service vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) extent cache mechanism. During error paths in f2fs_zero_range(), a zero-sized extent can be incorrectly inserted into the extent cache, causing a kernel BUG (invalid opcode exception) at fs/f2fs/extent_cache.c:678 when __update_extent_tree_range attempts to process it. The vulnerability was discovered via syzbot fuzzing and published on January 13, 2026. It affects Linux kernel versions from 4.7 up to the patched stable releases, and was also identified in Microsoft's Azure Linux kernel azl3_kernel_6.6.119.3-3. It carries a CVSS v3.1 base score of 5.0 (Medium) (Feedly, Microsoft MSRC).

The root cause is improper input validation (CWE class: insufficient validation) in the F2FS file system's extent cache update logic. When f2fs_zero_range() encounters an error mid-operation, it may call f2fs_update_read_extent_cache_range() with a zero-length extent, which is then passed to __update_extent_tree_range(). This function contains an explicit BUG assertion that fires when it encounters a zero-sized extent, triggering a kernel panic. The attack vector is local: an attacker with low privileges can invoke the fallocate syscall with the FALLOC_FL_ZERO_RANGE flag on an F2FS-mounted filesystem to trigger the error path. The call chain is: vfs_fallocate → f2fs_fallocate → f2fs_zero_range → f2fs_do_zero_range → f2fs_update_read_extent_cache_range → __update_extent_tree_range (Feedly).

Successful exploitation causes a kernel panic (system crash), resulting in a complete denial of service for the affected host. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any system running a vulnerable Linux kernel with an F2FS-formatted filesystem mounted is at risk, including cloud environments using Azure Linux kernel azl3_kernel_6.6.119.3-3 (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability was originally discovered and reported by syzbot (Google's automated kernel fuzzer), indicating it was found through automated fuzzing rather than targeted research. The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing F2FS-fs: __update_extent_tree_range: extent len is zero followed by kernel BUG at fs/f2fs/extent_cache.c:678 and an Oops: invalid opcode crash dump.
• Process: Unexpected system reboots or kernel panics traceable to processes invoking fallocate with FALLOC_FL_ZERO_RANGE on F2FS-mounted volumes.
• File System: Presence of F2FS-formatted volumes on systems experiencing unexplained kernel crashes.

Apply the relevant stable kernel patches immediately. Fixed versions include Linux kernel 6.1.160, 6.6.120, 6.12.64, 6.18.3, and 6.19-rc1. For Azure Linux users, update to azl3_kernel version 6.6.120 or later. As a temporary workaround where patching is not immediately possible, restrict local user access to F2FS-mounted filesystems or avoid using F2FS on systems that do not require it. Patch commits are available in the kernel stable repositories (Feedly, Microsoft MSRC, Debian LTS).