CVE-2025-68361 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
erofs: limit the level of fs stacking for file-backed mounts
Otherwise, it could cause potential kernel stack overflow (e.g., EROFS mounting itself).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 12/29/2025
The vulnerability identified as CVE-2025-68361 resides within the Linux kernel's implementation of the erofs filesystem driver, specifically addressing a critical flaw in how file-backed mounts handle filesystem stacking operations. This issue manifests when the erofs filesystem attempts to mount itself or other filesystems in a stacked configuration, creating a recursive scenario that can lead to catastrophic system instability. The vulnerability represents a fundamental design oversight in the kernel's filesystem layer management, where proper bounds checking and recursion prevention mechanisms were insufficiently implemented. The flaw directly impacts the kernel's ability to maintain stable memory operations during complex mount scenarios, particularly when dealing with nested or layered filesystem configurations.
The technical root cause of this vulnerability stems from inadequate validation of filesystem stacking levels during mount operations, allowing for unlimited recursion in file-backed mount scenarios. When an erofs filesystem attempts to mount itself or other filesystems in a stacked configuration, the kernel's current implementation fails to enforce proper limits on the depth of such stacking operations. This absence of level limitation creates a scenario where the kernel's stack space can be exhausted through recursive mount operations, leading to a stack overflow condition that fundamentally compromises system stability. The vulnerability specifically affects the erofs filesystem implementation within the Linux kernel's VFS (Virtual File System) layer, where mount operations are processed without sufficient depth monitoring and recursion control mechanisms.
The operational impact of this vulnerability extends beyond simple system instability to potentially enable denial of service attacks that can crash entire systems or render them unresponsive. An attacker exploiting this vulnerability could construct malicious mount scenarios that trigger the recursive stacking behavior, causing the kernel to consume excessive stack space until system resources are exhausted. This creates a persistent threat that could be leveraged in various attack vectors including remote exploitation through network filesystems or local privilege escalation scenarios. The vulnerability's potential for causing kernel stack overflow directly relates to the kernel's memory management constraints and highlights the critical importance of proper resource bounds checking in kernel-space operations. The issue particularly affects systems heavily dependent on stacked filesystem configurations or those that frequently handle complex mount scenarios involving file-backed storage solutions.
Mitigation strategies for CVE-2025-68361 require immediate kernel updates that implement proper stacking level limits and recursion detection mechanisms within the erofs filesystem driver. System administrators should prioritize applying the latest kernel patches that address this specific vulnerability, as the fix typically involves implementing maximum depth limits for filesystem stacking operations and adding proper recursion detection logic. The solution aligns with established security practices for kernel development and follows principles outlined in the Common Weakness Enumeration framework under CWE-129, which addresses improper validation of array indices and recursive operation limits. Additionally, organizations should implement monitoring solutions that can detect unusual mount patterns or recursive filesystem operations that might indicate exploitation attempts. The ATT&CK framework categorizes this vulnerability under privilege escalation and denial of service tactics, emphasizing the need for comprehensive system hardening and proper kernel security configurations to prevent unauthorized access to kernel memory management functions.