PT-2025-51664 · Linux+3 · Linux Kernel+3

Published 2025-12-16 · Updated 2026-05-23 · CVE-2025-68251

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue in the erofs component can lead to infinite loops when processing corrupted subpage compact indexes. This occurs because the clusterofs variable can exceed the lclustersize for non-head lclusters. The flaw is triggered by crafted images and involves the z erofs load lcluster from disk() function and the check for m->type >= Z EROFS LCLUSTER TYPE MAX following the z erofs load {compact,full} lcluster() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2025-68251

OESA-2026-1303

OESA-2026-1304

OESA-2026-1305

USN-8029-1

USN-8029-2

USN-8029-3

USN-8030-1

USN-8048-1

Affected Products

Debian

Linuxmint

Linux Kernel

Ubuntu

References · 504

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68251.json · Exploit
• https://ubuntu.com/security/CVE-2025-68169 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40126 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40086 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68764 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-68251 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68798 · Security Note
• https://ubuntu.com/security/CVE-2025-40177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40311 · Security Note
• https://ubuntu.com/security/CVE-2025-40353 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40098 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40004 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40111 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40322 · Vendor Advisory