CVE-2025-68210

What it actually does

The vulnerability causes an infinite loop in the EROFS decompression logic when processing truncated Zstandard-compressed data from deliberately corrupted filesystem images.

Why it matters to the business

Affected Linux systems may experience denial of service through hangs or excessive CPU consumption when handling malicious EROFS images, disrupting availability until manual intervention or restart occurs.

How an attack unfolds

An attacker crafts an EROFS image containing incomplete Zstd-compressed data and induces a target system to process or mount the image, triggering the kernel decompression loop.

How to fix it

Upgrade to fixed kernel versions containing commit 4d0e0bb1908acac5b27d30b45c450e8ead97eb00 or package updates such as cloud-provider-aws-fips-1.29 to 1.29.8-r1 and equivalents.

How to confirm the fix worked

Confirm updated kernel or package versions are deployed and verify that crafted truncated Zstd images no longer cause infinite loops during mount or access operations.

Typical attack path

1. Create a malicious EROFS filesystem image with truncated Zstd data
2. Distribute or place the image on a target system
3. Cause the system to mount or access the image
4. Trigger the infinite loop in the decompression path

How to detect it

Inspect kernel logs and process traces for erofs-related threads stuck in decompression loops and correlate with high CPU utilization on systems handling EROFS mounts.

What your security team should do

• Apply the listed kernel and package fixes without delay
• Restrict mounting of untrusted EROFS images to trusted sources only
• Monitor systems for sustained high CPU usage during filesystem operations