CVE-2025-68796

Vulnerability

Overview

CVE-68796 is a denial-of-service vulnerability in the Linux kernel's f2fs filesystem. The root cause is a missing validation check in the extent cache update path. When f2fs_zero_range() is called (e.g., via fallocate()), and an error occurs during the operation, the function may attempt to insert a zero-sized extent into the extent cache. The extent cache's __update_extent_tree_range() function contains a BUG_ON assertion that triggers when it detects an extent with zero length, leading to a kernel panic. The syzkaller reproducer demonstrates this by calling fallocate() on an f2fs loop device, hitting the BUG_ON at extent_cache.c:678 [1].

Exploitation

Prerequisites

To trigger this vulnerability, an attacker needs local access to a system with an f2fs filesystem mounted and the ability to execute the fallocate() system call on a file within that filesystem. No special privileges are required beyond the ability to write to a file and invoke fallocate, making it a low-complexity local attack vector. The bug is triggered during error handling—when f2fs_zero_range takes an error path, it incorrectly adds a zero-length extent without first sanitizing its length [1].

Impact

Successful exploitation results in a kernel BUG and subsequent system crash, causing a denial-of-service condition. An attacker can repeatedly trigger the vulnerability to render the system unavailable. There is no evidence of privilege escalation or information disclosure; the impact is limited to availability [1].

Mitigation

Status The vulnerability was fixed in the Linux kernel by the commit referenced in [1] and backported to stable kernels as indicated by the commits in [2] and [3]. The fix adds a check to prevent inserting extents with zero length into the cache. Users should apply the latest kernel updates from their distribution or build a kernel containing the fix. No workaround is available; the only mitigation is to apply the patch.