fkie_cve-2025-68240
Vulnerability from fkie_nvd
Published
2025-12-16 15:15
Modified
2025-12-18 15:08
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: avoid having an active sc_timer before freeing sci
Because kthread_stop did not stop sc_task properly and returned -EINTR,
the sc_timer was not properly closed, ultimately causing the problem [1]
reported by syzbot when freeing sci due to the sc_timer not being closed.
Because the thread sc_task main function nilfs_segctor_thread() returns 0
when it succeeds, when the return value of kthread_stop() is not 0 in
nilfs_segctor_destroy(), we believe that it has not properly closed
sc_timer.
We use timer_shutdown_sync() to sync wait for sc_timer to shutdown, and
set the value of sc_task to NULL under the protection of lock
sc_state_lock, so as to avoid the issue caused by sc_timer not being
properly shutdowned.
[1]
ODEBUG: free active (active state 0) object: 00000000dacb411a object type: timer_list hint: nilfs_construction_timeout
Call trace:
nilfs_segctor_destroy fs/nilfs2/segment.c:2811 [inline]
nilfs_detach_log_writer+0x668/0x8cc fs/nilfs2/segment.c:2877
nilfs_put_super+0x4c/0x12c fs/nilfs2/super.c:509
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: avoid having an active sc_timer before freeing sci\n\nBecause kthread_stop did not stop sc_task properly and returned -EINTR,\nthe sc_timer was not properly closed, ultimately causing the problem [1]\nreported by syzbot when freeing sci due to the sc_timer not being closed.\n\nBecause the thread sc_task main function nilfs_segctor_thread() returns 0\nwhen it succeeds, when the return value of kthread_stop() is not 0 in\nnilfs_segctor_destroy(), we believe that it has not properly closed\nsc_timer.\n\nWe use timer_shutdown_sync() to sync wait for sc_timer to shutdown, and\nset the value of sc_task to NULL under the protection of lock\nsc_state_lock, so as to avoid the issue caused by sc_timer not being\nproperly shutdowned.\n\n[1]\nODEBUG: free active (active state 0) object: 00000000dacb411a object type: timer_list hint: nilfs_construction_timeout\nCall trace:\n nilfs_segctor_destroy fs/nilfs2/segment.c:2811 [inline]\n nilfs_detach_log_writer+0x668/0x8cc fs/nilfs2/segment.c:2877\n nilfs_put_super+0x4c/0x12c fs/nilfs2/super.c:509"
}
],
"id": "CVE-2025-68240",
"lastModified": "2025-12-18T15:08:06.237",
"metrics": {},
"published": "2025-12-16T15:15:53.173",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/2f65799e2a736d556d306440c4e1e8906736117a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/36049e81dc7f077e0e24d5b9688a7458beacef8f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9a6b60cb147d53968753a34805211d2e5e08c027"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…