CVE-2025-39924 in Linux
Summary
by MITRE • 10/01/2025
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix invalid algorithm for encoded extents
The current algorithm sanity checks do not properly apply to new encoded extents.
Unify the algorithm check with Z_EROFS_COMPRESSION(_RUNTIME)_MAX and ensure consistency with sbi->available_compr_algs.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/08/2026
The vulnerability CVE-2025-39924 addresses a critical issue within the Linux kernel's erofs (Erofs File System) implementation that affects how encoded extents are validated during file system operations. This flaw resides in the compression algorithm sanity checking mechanism specifically designed for encoded extents, which are used to optimize storage efficiency in the erofs file system. The vulnerability manifests when the current algorithm validation process fails to properly account for new encoded extent types, potentially allowing malicious or malformed data to bypass critical integrity checks that should prevent invalid compression operations from being processed.
The technical flaw stems from inconsistent validation logic within the erofs kernel module where the existing sanity checks for compression algorithms do not adequately cover the newer encoded extent formats. This inconsistency creates a potential attack surface where an attacker could manipulate file system metadata to include invalid compression algorithm references that would otherwise be rejected by proper validation routines. The vulnerability specifically impacts the relationship between the Z_EROFS_COMPRESSION_RUNTIM_MAX constant and the sbi->available_compr_algs field, which are critical components for maintaining compression algorithm consistency within the file system's metadata structures.
The operational impact of this vulnerability extends beyond simple data corruption risks to potentially enable privilege escalation attacks or denial of service conditions within systems utilizing erofs file systems. When the compression algorithm validation fails, it may allow malformed extent data to be processed, which could lead to memory corruption, system instability, or unauthorized access to file system resources. Systems running Linux kernels with erofs support that process user-provided or untrusted file system images become particularly vulnerable to exploitation, as the flaw affects core file system functionality rather than peripheral components.
Mitigation strategies for CVE-2025-39924 require immediate kernel updates that implement unified algorithm checks consistent with Z_EROFS_COMPRESSION_RUNTIM_MAX and ensure proper synchronization with sbi->available_compr_algs. Organizations should prioritize patching affected systems and monitoring for any unusual file system behavior or performance degradation that might indicate exploitation attempts. Security teams should also consider implementing additional file system integrity monitoring measures and reviewing access controls for systems that handle untrusted file system content. This vulnerability aligns with CWE-129 and CWE-131 categories related to improper validation of input boundaries and insufficient validation of length of buffers, while potentially mapping to ATT&CK techniques involving privilege escalation through kernel vulnerabilities and file system manipulation. The fix ensures that all encoded extent validation routines maintain consistent algorithm checking standards, preventing invalid compression operations from being processed and maintaining the integrity of the erofs file system's compression mechanisms.