Executive brief
A vulnerability in the Linux kernel's EROFS file system driver can lead to a system hang or infinite loop. This occurs when the system attempts to read a specially crafted or corrupted disk image. An attacker could use this to cause a denial-of-service, effectively freezing the operating system and disrupting business operations.
Technical details
An infinite loop vulnerability exists in the EROFS (Enhanced Read-Only File System) implementation within the Linux kernel. The issue is caused by insufficient validation of 'clusterofs' values in corrupted subpage compact indexes, where 'clusterofs' can exceed the 'lclustersize'. This occurs specifically in the z_erofs_load_lcluster_from_disk() function. An attacker can trigger this by providing a specially crafted EROFS image. The fix involves moving and consolidating sanity checks for cluster offsets and cluster types to ensure they are validated immediately after being loaded from disk. Patches have been merged into the Linux stable tree.
Affected products
- Linux Linux Kernel All versions prior to the fix in zmap.c
Timeline
- 2025-10-17: disclosed: Vulnerability reported and patch authored by Gao Xiang
- 2025-10-29: patched: Patch committed to Linux stable tree by Greg Kroah-Hartman
- 2025-12-16: advisory: CVE-2025-68251 published