CVE-2025-68240 nilfs2: avoid having an active sc_timer before freeing sci
A use-after-free vulnerability in the Linux kernel nilfs2 filesystem allows local attackers to cause a denial of service via improper timer shutdown.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68240?
CVE-2025-68240 is an use after free vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: avoid having an active sc_timer before freeing sci
Because kthread_stop did not stop sc_task properly and returned -EINTR, the sc_timer was not properly closed, ultimately causing the problem [1] reported by syzbot when freeing sci due to the sc_timer not being closed.
Because the thread sc_task main function nilfs_segctor_thread() returns 0 when it succeeds, when the return value of kthread_stop() is not 0 in nilfs_segctor_destroy(), we believe that it has not properly closed sc_timer.
We use timer_shutdown_sync() to sync wait for sc_timer to shutdown, and set the value of sc_task to NULL under the protection of lock sc_state_lock, so as to avoid the issue caused by sc_timer not being properly shutdowned.
[1] ODEBUG: free active (active state 0) object: 00000000dacb411a object type: timer_list hint: nilfs_construction_timeout Call trace: nilfs_segctor_destroy fs/nilfs2/segment.c:2811 [inline] nilfs_detach_log_writer+0x668/0x8cc fs/nilfs2/segment.c:2877 nilfs_put_super+0x4c/0x12c fs/nilfs2/super.c:509
Which versions are affected by CVE-2025-68240?
How do I fix CVE-2025-68240?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-68240 being exploited?
There is no known exploitation of CVE-2025-68240 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68240, DEBIAN-CVE-2025-68240, GHSA-m6q3-c8gp-2rp9, ROOT-OS-DEBIAN-13-CVE-2025-68240, UBUNTU-CVE-2025-68240.