CVE-2025-68251
Low risk· EPSS 8%Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel, the erofs filesystem can enter an infinite loop when subpage compact indexes are corrupted. The root cause is that clusterofs can exceed lclustersize for non-NONHEAD lclusters. The fix moves the corresponding check into z_erofs_load_lcluster_from_disk().
Risk Assessment
Mounting a crafted erofs image can cause a kernel hang (infinite loop), resulting in a denial of service (DoS).
Recommendation
Update the Linux kernel to a version containing the erofs fix and avoid mounting untrusted erofs images.
Other vulnerabilities in Linux kernel (erofs)
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: erofs: avoid infinite loops due to corrupted subpage compact indexes Robert reported an infinite loop observed by two crafted images. The root cause is that `clusterofs` can be larger than `lclustersize` for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.: blocksize = lclustersize = 512 lcn = 6 clusterofs = 515 Move the corresponding check for full compress indexes to `z_erofs_load_lcluster_from_disk()` to also cover subpage compact compress indexes. It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX` check, since it should be placed right after `z_erofs_load_{compact,full}_lcluster()`.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS