CVE-2025-68240

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: avoid having an active sc_timer before freeing sci

Because kthread_stop did not stop sc_task properly and returned -EINTR,

the sc_timer was not properly closed, ultimately causing the problem [1]

reported by syzbot when freeing sci due to the sc_timer not being closed.

Because the thread sc_task main function nilfs_segctor_thread() returns 0

when it succeeds, when the return value of kthread_stop() is not 0 in

nilfs_segctor_destroy(), we believe that it has not properly closed

sc_timer.

We use timer_shutdown_sync() to sync wait for sc_timer to shutdown, and

set the value of sc_task to NULL under the protection of lock

sc_state_lock, so as to avoid the issue caused by sc_timer not being

properly shutdowned.

[1]

ODEBUG: free active (active state 0) object: 00000000dacb411a object type: timer_list hint: nilfs_construction_timeout

Call trace:

nilfs_segctor_destroy fs/nilfs2/segment.c:2811 [inline]

nilfs_deta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References