CVE-2025-68168

Vulnerability

Details The JFS filesystem transaction manager in the Linux kernel had an initialization bug where txInit() failed to properly initialize the waitqueue for TxBlock[0]. The loop that initializes all transaction blocks skipped index 0, leaving the waitqueue at that index uninitialized [1].

Exploitation

This issue is triggered when a JFS filesystems mounted read-only. When such a filesystem is mounted, txBegin() returns tid=0 to indicate no transaction can start. However, txEnd(0) still gets called, and via tid_to_tblock(0), it accesses TxBlock[0].waitor, which was never initialized. This leads to a 'non-static key' lockdep warning and a system crash [2].

Impact

A local attacker with the ability to mount a JFS filesystem read-only can crash the system by simply triggering the mount and any subsequent I/O path. An attacker could also craft a malicious filesystem image that, when mounted read-only, triggers this path to cause a denial of service. The crash manifests as a kernel Oops or panic due to trying to register a invalid key state.

Mitigation

The fix is to ensure all transaction blocks including TxBlock[0] have their waitqueues properly initialized during txInit() [3]. The upstream kernel has been patched [4]. Users should apply the latest stable kernel update. There is no workaround available other than not using read-only JFS mounts.