CVE-2025-68266

Vulnerability

Description

In the Linux kernel's BFS filesystem, the inode->i_mode S_IFMT bits can become corrupted when loading from disk due to insufficient validation. The BFS documentation indicates that only the lower 9 bits of the mode field are used, but the upper bits (including S_IFMT) are not guaranteed to be zero. Additionally, the 'attributes' field, which indicates file type, is not verified against the expected values (BFS_VREG or BFS_VDIR). This allows an attacker with the ability to write to a BFS filesystem image to craft corrupted mode or attributes fields, leading to a kernel state with invalid inode modes.

Exploitation

To exploit this vulnerability, an attacker needs to be able to mount a specially crafted BFS filesystem image. This could be achieved through physical access, a malicious storage device, or by loading a corrupted filesystem from a network source. The vulnerability does not require authenticated access to the system if the attacker can trigger filesystem mount. Once mounted, the kernel reads the corrupted on-disk structures into memory, resulting in an inode with an invalid mode.

Impact

A corrupted inode mode can cause the kernel to misinterpret the file type, leading to incorrect permission checks or type-specific operations. This may result in denial of service (kernel panic or crash) or potentially memory corruption if the invalid mode triggers unexpected code paths. The specific impact depends on how the corrupted inode is subsequently used.

Mitigation

The vulnerability is fixed in kernel commits [1], [2], and [3] which sanitize the mode by ignoring S_IFMT bits from disk and validating the attributes field against expected file types. Users should update to a kernel version containing these patches. No workaround is available other than not mounting untrusted BFS filesystems.