Linux Kernel up to 6.17.5 z_erofs_load_lcluster_from_disk infinite loop

Summaryinfo

A vulnerability marked as critical has been reported in Linux Kernel up to 6.17.5. Affected by this vulnerability is the function z_erofs_load_lcluster_from_disk. The manipulation leads to infinite loop. This vulnerability is traded as CVE-2025-68251. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.17.5. This issue affects the function z_erofs_load_lcluster_from_disk. The manipulation with an unknown input leads to a infinite loop vulnerability. Using CWE to declare the problem leads to CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Impacted is availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: erofs: avoid infinite loops due to corrupted subpage compact indexes Robert reported an infinite loop observed by two crafted images. The root cause is that `clusterofs` can be larger than `lclustersize` for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.: blocksize = lclustersize = 512 lcn = 6 clusterofs = 515 Move the corresponding check for full compress indexes to `z_erofs_load_lcluster_from_disk()` to also cover subpage compact compress indexes. It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX` check, since it should be placed right after `z_erofs_load_{compact,full}_lcluster()`.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2025-68251 since 12/16/2025. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 298897 (Ubuntu 25.10 : Linux kernel vulnerabilities (USN-8029-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.17.6 eliminates this vulnerability. Applying the patch 8675447a8794983f2b7e694b378112772c17635e/e13d315ae077bb7c3c6027cc292401bc0f4ec683 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (298897), EUVD (EUVD-2025-203645) and CERT Bund (WID-SEC-2025-2868). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.17.0
• 6.17.1
• 6.17.2
• 6.17.3
• 6.17.4
• 6.17.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion