CVE-2025-68364

What it actually does

The vulnerability allowed a BUG() assertion in __ocfs2_move_extent() to trigger a full kernel panic when encountering ocfs2 filesystem corruption instead of logging an error and continuing.

Why it matters to the business

Systems using the ocfs2 filesystem risk unexpected kernel crashes and service interruptions from corruption events; the low exploit probability and long availability of fixes limit widespread operational risk.

How an attack unfolds

An attacker with local access or the ability to induce filesystem corruption triggers the __ocfs2_move_extent() path, causing the kernel to hit the BUG() and crash, resulting in denial of service; no named threat actors have been observed exploiting this issue.

How to fix it

Update to a fixed kernel containing commit cb34a55f552960c74e26b3699c84745b96e3131a or, for the Chainguard volume-modifier-for-k8s-fips package, upgrade to version 0.5.1-r4 or later.

How to confirm the fix worked

Verify the running kernel includes the referenced commit or package version; confirm ocfs2_error() replaces the prior BUG() call in __ocfs2_move_extent().

Typical attack path

1. Gain local access or ability to corrupt ocfs2 filesystem structures
2. Trigger extent move operations in the affected kernel code path
3. Force the BUG() assertion to execute and panic the kernel

How to detect it

Search kernel logs for ocfs2_error() messages originating from extent-move operations and any preceding BUG() panics referencing __ocfs2_move_extent(); no public exploitation artifacts are known.

What your security team should do

• Apply the kernel or package update immediately on all systems using ocfs2
• Monitor for ocfs2 filesystem errors in system logs as an indicator of potential corruption
• Review backup and recovery procedures for ocfs2 volumes