CVE-2025-68251
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: erofs: avoid infinite loops due to corrupted subpage compact indexes Robert reported an infinite loop observed by two crafted images. The root cause is that `clusterofs` can be larger than `lclustersize` for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.: blocksize = lclustersize = 512 lcn = 6 clusterofs = 515 Move the corresponding check for full compress indexes to `z_erofs_load_lcluster_from_disk()` to also cover subpage compact compress indexes. It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX` check, since it should be placed right after `z_erofs_load_{compact,full}_lcluster()`.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-12-16 15:15:54.413000
Last modified
2026-10-21 13:18:21.770000
View original CVE JSON
{
"id": "CVE-2025-68251",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-12-16T15:15:54.413",
"lastModified": "2026-10-21T13:18:21.770",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: avoid infinite loops due to corrupted subpage compact indexes\n\nRobert reported an infinite loop observed by two crafted images.\n\nThe root cause is that `clusterofs` can be larger than `lclustersize`\nfor !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:\n\n blocksize = lclustersize = 512 lcn = 6 clusterofs = 515\n\nMove the corresponding check for full compress indexes to\n`z_erofs_load_lcluster_from_disk()` to also cover subpage compact\ncompress indexes.\n\nIt also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX`\ncheck, since it should be placed right after\n`z_erofs_load_{compact,full}_lcluster()`."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nerofs: evitar bucles infinitos debido a índices compactos de subpágina corruptos\n\nRobert informó de un bucle infinito observado en dos imágenes manipuladas.\n\nLa causa raíz es que 'clusterofs' puede ser mayor que 'lclustersize' para 'lclusters' !NONHEAD en índices compactos de subpágina corruptos, p. ej.:\n\nblocksize = lclustersize = 512 lcn = 6 clusterofs = 515\n\nMover la comprobación correspondiente para índices de compresión completos a 'z_erofs_load_lcluster_from_disk()' para cubrir también los índices de compresión compactos de subpágina.\n\nTambién corrige la posición de la comprobación 'm -> type >= Z_EROFS_LCLUSTER_TYPE_MAX', ya que debería colocarse justo después de 'z_erofs_load_{compact,full}_lcluster()'."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/erofs/zmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3f691aa676f29586e83e6c032713554a290418c3",
"lessThan": "b18a82503a67a530d48f5a5b429e162749fe2c89",
"versionType": "git",
"status": "affected"
},
{
"version": "8d2517aaeea3ab8651bb517bca8f3c8664d318ea",
"lessThan": "dbfac1b85d0753996ddfef636934d431b588dd1f",
"versionType": "git",
"status": "affected"
},
{
"version": "8d2517aaeea3ab8651bb517bca8f3c8664d318ea",
"lessThan": "8675447a8794983f2b7e694b378112772c17635e",
"versionType": "git",
"status": "affected"
},
{
"version": "8d2517aaeea3ab8651bb517bca8f3c8664d318ea",
"lessThan": "e13d315ae077bb7c3c6027cc292401bc0f4ec683",
"versionType": "git",
"status": "affected"
},
{
"version": "22438a34d383ec2789eaf450728e38abc53051f8",
"versionType": "git",
"status": "affected"
},
{
"version": "6.6.16",
"lessThan": "6.6.160",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.7.4",
"lessThan": "6.8",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/erofs/zmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.8",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.8",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.91",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.6",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/8675447a8794983f2b7e694b378112772c17635e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b18a82503a67a530d48f5a5b429e162749fe2c89",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dbfac1b85d0753996ddfef636934d431b588dd1f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e13d315ae077bb7c3c6027cc292401bc0f4ec683",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}