CVE-2025-68251

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68251", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T13:41:40.266Z", "datePublished": "2025-12-16T14:32:17.979Z", "dateUpdated": "2026-10-21T12:38:08.014Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:38:08.014Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: avoid infinite loops due to corrupted subpage compact indexes\n\nRobert reported an infinite loop observed by two crafted images.\n\nThe root cause is that `clusterofs` can be larger than `lclustersize`\nfor !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:\n\n blocksize = lclustersize = 512 lcn = 6 clusterofs = 515\n\nMove the corresponding check for full compress indexes to\n`z_erofs_load_lcluster_from_disk()` to also cover subpage compact\ncompress indexes.\n\nIt also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX`\ncheck, since it should be placed right after\n`z_erofs_load_{compact,full}_lcluster()`."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/zmap.c"], "versions": [{"version": "3f691aa676f29586e83e6c032713554a290418c3", "lessThan": "b18a82503a67a530d48f5a5b429e162749fe2c89", "status": "affected", "versionType": "git"}, {"version": "8d2517aaeea3ab8651bb517bca8f3c8664d318ea", "lessThan": "dbfac1b85d0753996ddfef636934d431b588dd1f", "status": "affected", "versionType": "git"}, {"version": "8d2517aaeea3ab8651bb517bca8f3c8664d318ea", "lessThan": "8675447a8794983f2b7e694b378112772c17635e", "status": "affected", "versionType": "git"}, {"version": "8d2517aaeea3ab8651bb517bca8f3c8664d318ea", "lessThan": "e13d315ae077bb7c3c6027cc292401bc0f4ec683", "status": "affected", "versionType": "git"}, {"version": "22438a34d383ec2789eaf450728e38abc53051f8", "status": "affected", "versionType": "git"}, {"version": "6.6.16", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "6.7.4", "lessThan": "6.8", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/zmap.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.6", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.16", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.17.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b18a82503a67a530d48f5a5b429e162749fe2c89"}, {"url": "https://git.kernel.org/stable/c/dbfac1b85d0753996ddfef636934d431b588dd1f"}, {"url": "https://git.kernel.org/stable/c/8675447a8794983f2b7e694b378112772c17635e"}, {"url": "https://git.kernel.org/stable/c/e13d315ae077bb7c3c6027cc292401bc0f4ec683"}], "title": "erofs: avoid infinite loops due to corrupted subpage compact indexes", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/erofs/zmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b18a82503a67a530d48f5a5b429e162749fe2c89", "status": "affected", "version": "3f691aa676f29586e83e6c032713554a290418c3", "versionType": "git"}, {"lessThan": "dbfac1b85d0753996ddfef636934d431b588dd1f", "status": "affected", "version": "8d2517aaeea3ab8651bb517bca8f3c8664d318ea", "versionType": "git"}, {"lessThan": "8675447a8794983f2b7e694b378112772c17635e", "status": "affected", "version": "8d2517aaeea3ab8651bb517bca8f3c8664d318ea", "versionType": "git"}, {"lessThan": "e13d315ae077bb7c3c6027cc292401bc0f4ec683", "status": "affected", "version": "8d2517aaeea3ab8651bb517bca8f3c8664d318ea", "versionType": "git"}, {"status": "affected", "version": "22438a34d383ec2789eaf450728e38abc53051f8", "versionType": "git"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.16", "versionType": "semver"}, {"lessThan": "6.8", "status": "affected", "version": "6.7.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/erofs/zmap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: avoid infinite loops due to corrupted subpage compact indexes\n\nRobert reported an infinite loop observed by two crafted images.\n\nThe root cause is that `clusterofs` can be larger than `lclustersize`\nfor !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:\n\n blocksize = lclustersize = 512 lcn = 6 clusterofs = 515\n\nMove the corresponding check for full compress indexes to\n`z_erofs_load_lcluster_from_disk()` to also cover subpage compact\ncompress indexes.\n\nIt also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX`\ncheck, since it should be placed right after\n`z_erofs_load_{compact,full}_lcluster()`."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nerofs: evitar bucles infinitos debido a \u00edndices compactos de subp\u00e1gina corruptos\n\nRobert inform\u00f3 de un bucle infinito observado en dos im\u00e1genes manipuladas.\n\nLa causa ra\u00edz es que 'clusterofs' puede ser mayor que 'lclustersize' para 'lclusters' !NONHEAD en \u00edndices compactos de subp\u00e1gina corruptos, p. ej.:\n\nblocksize = lclustersize = 512 lcn = 6 clusterofs = 515\n\nMover la comprobaci\u00f3n correspondiente para \u00edndices de compresi\u00f3n completos a 'z_erofs_load_lcluster_from_disk()' para cubrir tambi\u00e9n los \u00edndices de compresi\u00f3n compactos de subp\u00e1gina.\n\nTambi\u00e9n corrige la posici\u00f3n de la comprobaci\u00f3n 'm -> type >= Z_EROFS_LCLUSTER_TYPE_MAX', ya que deber\u00eda colocarse justo despu\u00e9s de 'z_erofs_load_{compact,full}_lcluster()'."}], "id": "CVE-2025-68251", "lastModified": "2026-10-21T13:18:21.770", "metrics": {}, "published": "2025-12-16T15:15:54.413", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8675447a8794983f2b7e694b378112772c17635e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b18a82503a67a530d48f5a5b429e162749fe2c89"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dbfac1b85d0753996ddfef636934d431b588dd1f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e13d315ae077bb7c3c6027cc292401bc0f4ec683"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: erofs: avoid infinite loops due to corrupted subpage compact indexes", "id": "2422756", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422756"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-68251", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68251\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68251\nhttps://lore.kernel.org/linux-cve-announce/2025121624-CVE-2025-68251-782f@gregkh/T"], "threat_severity": "Low"}

{}