CVE-2025-68266

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bfs: Reconstruct file type when loading from disk

syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when

the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted

or when the 32bits "attributes" field loaded from disk are corrupted.

A documentation says that BFS uses only lower 9 bits of the "mode" field.

But I can't find an explicit explanation that the unused upper 23 bits

(especially, the S_IFMT bits) are initialized with 0.

Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk.

Also, verify that the value of the "attributes" field loaded from disk is

either BFS_VREG or BFS_VDIR (because BFS supports only regular files and

the root directory).

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References