CVEvulnerability
CVE-2025-68251
- Status
- Deferred
- Published
- 2025-12-16
- Last modified
- 2026-10-21
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Description
In the Linux kernel, the following vulnerability has been resolved:
erofs: avoid infinite loops due to corrupted subpage compact indexes
Robert reported an infinite loop observed by two crafted images.
The root cause is that `clusterofs` can be larger than `lclustersize`
for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:
blocksize = lclustersize = 512 lcn = 6 clusterofs = 515
Move the corresponding check for full compress indexes to
`z_erofs_load_lcluster_from_disk()` to also cover subpage compact
compress indexes.
It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX`
check, since it should be placed right after
`z_erofs_load_{compact,full}_lcluster()`.
References
- https://git.kernel.org/stable/c/8675447a8794983f2b7e694b378112772c17635e git.kernel.org
- https://git.kernel.org/stable/c/b18a82503a67a530d48f5a5b429e162749fe2c89 git.kernel.org
- https://git.kernel.org/stable/c/dbfac1b85d0753996ddfef636934d431b588dd1f git.kernel.org
- https://git.kernel.org/stable/c/e13d315ae077bb7c3c6027cc292401bc0f4ec683 git.kernel.org