In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix kernel BUG in ocfs2findvictim_chain
syzbot reported a kernel BUG in ocfs2findvictimchain() because the
cl_next_free_rec field of the allocation chain list (next free slot in
the chain list) is 0, triggring the BUGON(!cl->clnextfreerec)
condition in ocfs2findvictimchain() and panicking the kernel.
To fix this, an if condition is introduced in ocfs2claimsuballocbits(), just before calling ocfs2findvictimchain(), the code block in it being executed when either of the following conditions is true:
cl_next_free_rec is equal to 0, indicating that there are no free
chains in the allocation chain listcl_next_free_rec is greater than cl_count (the total number of
chains in the allocation chain list)Either of them being true is indicative of the fact that there are no chains left for usage.
This is addressed using ocfs2_error(), which prints the error log for debugging purposes, rather than panicking the kernel.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68771.json",
"cna_assigner": "Linux"
}