CVE-2025-68361

What it actually does

Unrestricted filesystem stacking depth in erofs file-backed mounts allows recursive self-mounting that exhausts kernel stack space and triggers overflow.

Why it matters to the business

Systems may experience sudden kernel crashes or instability when untrusted or specially crafted filesystem images are mounted, leading to denial of service and potential data loss during recovery.

How an attack unfolds

An attacker supplies or induces mounting of an erofs image configured for deep nesting; the kernel follows the mount chain without depth checks until stack exhaustion occurs, crashing the system.

How to fix it

Update the Linux kernel to a version containing commit 34447aeedbaea8f9aad3da5b07030a1c0e124639 or later that enforces a stacking depth limit for erofs file-backed mounts. Rebuild and reboot affected systems after applying the update.

How to confirm the fix worked

Confirm the running kernel includes the depth-limiting change in fs/erofs; attempt a controlled self-mount test in an isolated environment and verify the operation is rejected before stack exhaustion.

Typical attack path

1. Obtain or create an erofs image that references itself or another erofs image in a loop
2. Trigger a file-backed mount of the image via local user, container runtime, or automated mount service
3. Kernel performs repeated stacking operations without limit
4. Stack overflow occurs resulting in kernel panic or oops

How to detect it

Review kernel logs for oops or panic messages containing erofs and stack overflow indicators; inspect mount operations and audit logs for repeated or nested erofs file-backed mounts from untrusted sources.

What your security team should do

• Prioritize kernel updates on all systems that support erofs mounts
• Restrict unprivileged users from performing filesystem mounts until patched
• Monitor for kernel oops or panic events referencing erofs stack operations