CVE-2025-68266 In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk…
Description
In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted. A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0. Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux 6.18 | earliest → < 6.18 | 6.18 |
| Linux 6.17 | earliest → < 6.17.12 | 6.17.12 |
| Linux 6.12 | earliest → < 6.12.62 | 6.12.62 |
| Linux 6.6 | earliest → < 6.6.120 | 6.6.120 |
| Linux 6.1 | earliest → < 6.1.160 | 6.1.160 |
| Linux 5.15 | earliest → < 5.15.198 | 5.15.198 |
| Linux 5.10 | earliest → < 5.10.248 | 5.10.248 |
| Linux | 2.6.12 | No fix stated |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.7 → latest | No fix stated |
Show the 2 other branches Hide the 2 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.7 → latest | No fix stated |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.7 → latest | No fix stated |