CVE-2025-68266

In the Linux kernel, the following vulnerability has been resolved:

bfs: Reconstruct file type when loading from disk

syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits mode field loaded from disk are corrupted or when the 32bits attributes field loaded from disk are corrupted.

A documentation says that BFS uses only lower 9 bits of the mode field. But I cant find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0.

Therefore, ignore the S_IFMT bits of the mode field loaded from disk. Also, verify that the value of the attributes field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).

Affected Software

References

• https://git.kernel.org/stable/c/34ab4c75588c07cca12884f2bf6b0347c7a13872
• https://git.kernel.org/stable/c/77899444d46162aeb65f229590c26ba266864223
• https://git.kernel.org/stable/c/a8cb796e7e2cb7971311ba236922f5e7e1be77e6