CVE-2025-68251

CVE-2025-68251

published December 16, 2025

CVSS
—
EPSS
0%
Percentile
7.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

erofs: avoid infinite loops due to corrupted subpage compact indexes

Robert reported an infinite loop observed by two crafted images.

The root cause is that `clusterofs` can be larger than `lclustersize`

for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:

blocksize = lclustersize = 512 lcn = 6 clusterofs = 515

Move the corresponding check for full compress indexes to

`z_erofs_load_lcluster_from_disk()` to also cover subpage compact

compress indexes.

It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX`

check, since it should be placed right after

`z_erofs_load_{compact,full}_lcluster()`.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00187 · 7.9th percentile
Published
2025-12-16T20:15Z
References (4)
EPSS history
Timeline
  • 16 DEC 14:32Z
    erofs: avoid infinite loops due to corrupted subpage compact indexes
    cvelistv5