CVE-2025-68771

Root

Cause

The vulnerability exists in the ocfs2_find_victim_chain() function within the Linux kernel's OCFS2 filesystem. The function contained a BUG_ON(!cl->cl_next_free_rec) assertion, which would trigger a kernel panic if the cl_next_free_rec field—indicating the next free slot in an allocation chain list—was zero. Syzbot discovered that this condition could be reached, causing a denial-of-service by crashing the system [1][2].

Exploitation

An attacker able to trigger filesystem operations that reach the ocfs2_claim_suballoc_bits() path may cause cl_next_free_rec to become zero or to exceed cl_count (the total number of chains). No special privileges beyond the ability to interact with an OCFS2 mount are required; the issue can be triggered locally through crafted filesystem activity [1][2].

Impact

Successful exploitation leads to a kernel BUG, resulting in a denial-of-service (system crash). There is no indication of memory corruption or privilege escalation—the impact is strictly availability [1][2].

Mitigation

The fix replaces the unconditional BUG_ON with an ocfs2_error() call (when either cl_next_free_rec == 0 or cl_next_free_rec > cl_count), which logs the error and handles the situation gracefully without panicking the kernel. The patch has been committed to the stable kernel tree [1][2]. Administrators should apply the update to patched kernels as soon as possible.