CVE-2025-68251: erofs: avoid infinite loops due to corrupted subpage compact indexes

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-16 · updated 2026-10-21

Description

In the Linux kernel, the following vulnerability has been resolved: erofs: avoid infinite loops due to corrupted subpage compact indexes Robert reported an infinite loop observed by two crafted images. The root cause is that `clusterofs` can be larger than `lclustersize` for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.: blocksize = lclustersize = 512 lcn = 6 clusterofs = 515 Move the corresponding check for full compress indexes to `z_erofs_load_lcluster_from_disk()` to also cover subpage compact compress indexes. It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX` check, since it should be placed right after `z_erofs_load_{compact,full}_lcluster()`.

Affected products

Linux kernel: from 6.6.16 before 6.6.160; from 6.7.4 before 6.8; 6.8 — fixed in 6.18, 6.6.160, 6.8

How to fix

Upgrade to a fixed version: Linux kernel 6.18, 6.6.160, 6.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-68251 or the next vulnerability affects your stack