CVE-2025-68251
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
16/12/2025
Last modified:
18/12/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
erofs: avoid infinite loops due to corrupted subpage compact indexes<br />
<br />
Robert reported an infinite loop observed by two crafted images.<br />
<br />
The root cause is that `clusterofs` can be larger than `lclustersize`<br />
for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:<br />
<br />
blocksize = lclustersize = 512 lcn = 6 clusterofs = 515<br />
<br />
Move the corresponding check for full compress indexes to<br />
`z_erofs_load_lcluster_from_disk()` to also cover subpage compact<br />
compress indexes.<br />
<br />
It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX`<br />
check, since it should be placed right after<br />
`z_erofs_load_{compact,full}_lcluster()`.