CVE-2025-68356

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Prevent recursive memory reclaim

Function new_inode() returns a new inode with inode->i_mapping->gfp_mask

set to GFP_HIGHUSER_MOVABLE. This value includes the __GFP_FS flag, so

allocations in that address space can recurse into filesystem memory

reclaim. We don't want that to happen because it can consume a

significant amount of stack memory.

Worse than that is that it can also deadlock: for example, in several

places, gfs2_unstuff_dinode() is called inside filesystem transactions.

This calls filemap_grab_folio(), which can allocate a new folio, which

can trigger memory reclaim. If memory reclaim recurses into the

filesystem and starts another transaction, a deadlock will ensue.

To fix these kinds of problems, prevent memory reclaim from recursing

into filesystem code by making sure that the gfp_mask of inode address

spaces doesn't include __GFP_FS.

The "meta" and resource group address spaces were alread

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References