LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted

In the Linux kernel, the following vulnerability has been resolved: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted There's issue when file system corrupted: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1289! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0 RSP: 0018:ffff888117aafa30 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534 RDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010 RBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028 R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0 Call Trace: <TASK> __ext4_journal_get_create_access+0x42/0x170 ext4_getblk+0x319/0x6f0 ext4_bread+0x11/0x100 ext4_append+0x1e6/0x4a0 ext4_init_new_dir+0x145/0x1d0 ext4_mkdir+0x326/0x920 vfs_mkdir+0x45c/0x740 do_mkdirat+0x234/0x2f0 __x64_sys_mkdir+0xd6/0x120 do_syscall_64+0x5f/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The above issue occurs with us in errors=continue mode when accompanied by storage failures. There have been many inconsistencies in the file system data. In the case of file system data inconsistency, for example, if the block bitmap of a referenced block is not set, it can lead to the situation where a block being committed is allocated and used again. As a result, the following condition will not be satisfied then trigger BUG_ON. Of course, it is entirely possible to construct a problematic image that can trigger this BUG_ON through specific operations. In fact, I have constructed such an image and easily reproduced this issue. Therefore, J_ASSERT() holds true only under ideal conditions, but it may not necessarily be satisfied in exceptional scenarios. Using J_ASSERT() directly in abnormal situations would cause the system to crash, which is clearly not what we want. So here we directly trigger a JBD abort instead of immediately invoking BUG_ON.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-68337 is a Linux kernel availability issue in jbd2/ext4 journaling. With a corrupted filesystem, especially alongside storage failures, a normal filesystem operation such as creating a directory can hit a kernel BUG and crash the system.

Executive priority

Prioritize patching where Linux hosts process removable media, disk images, or unreliable storage. For ordinary servers with controlled storage and normal patch cadence, handle through scheduled kernel maintenance unless vendor guidance elevates urgency.

Technical view

The fix changes jbd2_journal_get_create_access() so an unexpected journal state caused by filesystem inconsistency triggers a JBD abort rather than BUG_ON. The source describes block bitmap inconsistency causing committed blocks to be allocated and reused, violating an assertion during ext4 operations.

Likely exposure

Exposure is most relevant to Linux systems using ext4/jbd2 that may mount corrupted or attacker-supplied filesystem images, or systems operating with storage failures and errors=continue behavior. The source bundle does not establish remote exposure.

Exploitation context

No KEV listing is provided, and the cited sources do not report active exploitation. The kernel description says a problematic filesystem image can be constructed and used to reproduce the crash, but it does not provide exploit status in the wild.

Researcher notes

Evidence supports a local availability impact through corrupted ext4/jbd2 state, not privilege escalation or remote code execution. Severity and CVSS are not provided. Affected-version details in the bundle are broad, so distribution-specific kernel mapping is required.

Mitigation direction

  • Update to a Linux kernel stable release containing the referenced jbd2 fix.
  • Check distribution and device-vendor advisories for packaged kernel availability.
  • Avoid mounting untrusted filesystem images on production systems.
  • Treat storage errors and ext4 corruption as operational incidents requiring repair or isolation.
  • Review Siemens SSA-019113 if Siemens products are in scope.

Validation and detection

  • Inventory Linux kernel versions across affected servers and appliances.
  • Confirm whether ext4 filesystems and jbd2 journaling are used.
  • Check vendor kernel changelogs for the referenced stable commits.
  • Review logs for ext4, jbd2, storage failure, or filesystem corruption messages.
  • Verify untrusted removable media or disk images are not mounted automatically.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68337 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux470decc613ab2048b619a01028072d932d9086ee, 470decc613ab2048b619a01028072d932d9086ee, 470decc613ab2048b619a01028072d932d9086ee, 470decc613ab2048b619a01028072d932d9086ee, 470decc613ab2048b619a01028072d932d9086ee, 470decc613ab2048b619a01028072d932d9086ee, 470decc613ab2048b619a01028072d932d9086ee, 470decc613ab2048b619a01028072d932d9086eeunaffected
LinuxLinux2.6.19, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.62, 6.17.12, 6.18.1, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.