LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68266: bfs: Reconstruct file type when loading from disk

In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted. A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0. Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the BFS filesystem parser. If BFS metadata on disk is corrupted, the kernel could accept bogus file-type bits or invalid attributes while loading inodes. The source bundle does not state a crash, privilege escalation, or data exposure outcome, so business urgency depends on whether systems mount BFS media or images.

Executive priority

Treat as a targeted kernel maintenance item, not an emergency, unless BFS media handling is part of business operations or exposed workflows. Prioritize normal kernel patching and vendor advisory review.

Technical view

The fix ignores S_IFMT bits from BFS inode mode loaded from disk and validates disk attributes as BFS_VREG or BFS_VDIR. The issue was reported by syzbot and resolved in Linux stable commits. The bundle provides no CVSS score, CWE, or concrete impact classification.

Likely exposure

Exposure appears limited to Linux systems with BFS filesystem support that mount BFS filesystems, especially from untrusted or corrupt disk images. Exact distribution package exposure is not provided in the bundle.

Exploitation context

The bundle does not report active exploitation, and KEV is false. Evidence shows a syzbot-discovered kernel bug involving corrupted on-disk BFS metadata, not a documented real-world attack path.

Researcher notes

The source data names corrupted BFS mode and attributes fields as the trigger condition. Impact is under-specified; focus analysis on inode type reconstruction, attribute validation, mount-time behavior, and distro backport status.

Mitigation direction

  • Update Linux kernels to builds containing the referenced upstream BFS fix.
  • Follow Linux distribution or device vendor advisories for backported package versions.
  • Avoid mounting untrusted BFS filesystems or disk images until patched.
  • For Siemens environments, review SSA-019113 for product-specific guidance.

Validation and detection

  • Inventory systems that support or mount BFS filesystems.
  • Check kernel package changelogs for the referenced BFS stable commits.
  • Confirm scanners map CVE-2025-68266 to installed kernel builds accurately.
  • Review operational paths where users can supply disk images or removable media.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68266 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2unaffected
LinuxLinux2.6.12, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.62, 6.17.12, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.