Executive brief
A vulnerability in the Linux kernel's journaling system (jbd2) can cause the entire operating system to crash when encountering a corrupted file system. This occurs because the system uses a 'panic' response (BUG_ON) when it detects certain data inconsistencies, rather than handling the error gracefully. An attacker or a failing storage device could trigger this crash, leading to a complete denial of service for the affected machine.
Technical details
A vulnerability exists in the jbd2_journal_get_create_access() function within fs/jbd2/transaction.c of the Linux kernel. The root cause is the use of J_ASSERT() (which triggers BUG_ON) to validate buffer head states that may be inconsistent due to external file system corruption or storage failures. Specifically, if a block being committed is prematurely reallocated due to a corrupted block bitmap, the assertion fails. An attacker with the ability to mount a specially crafted corrupted file system image or trigger specific disk inconsistencies can cause a kernel panic. The fix replaces the immediate BUG_ON with a JBD2 abort mechanism (returning -EROFS), allowing the system to handle the error without crashing.
Affected products
- Linux Linux Kernel 6.18.0-rc1-next
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-10-25: disclosed: Initial patch submission by Ye Bin
- 2025-11-26: patched: Commited to mainline kernel tree
- 2025-12-22: advisory: CVE-2025-68337 published
References
- https://git.kernel.org/stable/c/3faac6531d4818cd6be45e5bbf32937bbbc795c0
- https://git.kernel.org/stable/c/71bbe06c40fc59b5b15661eca8ff307f4176d7f9
- https://git.kernel.org/stable/c/986835bf4d11032bba4ab8414d18fce038c61bb4
- https://git.kernel.org/stable/c/a2a7f854d154a3e9232fec80782dad951655f52f
- https://git.kernel.org/stable/c/aa1703f3f706ea0867fb1991dcac709c9ec94cfb
- https://git.kernel.org/stable/c/b4f8eabf6d991bd41fabcdf9302c4b3eab590cf4
- https://git.kernel.org/stable/c/bf34c72337e40c4670cceeb79b353356933a254b