CVE-2025-40067
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption. syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT, due to unexpected index state. Reject such cases by verifying that the bitmap is not empty when index blocks exist.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-28 12:15:41.167000
Last modified
2026-10-30 13:18:12.920000
View original CVE JSON
{
"id": "CVE-2025-40067",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-28T12:15:41.167",
"lastModified": "2026-10-30T13:18:12.920",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist\n\nIndex allocation requires at least one bit in the $BITMAP attribute to\ntrack usage of index entries. If the bitmap is empty while index blocks\nare already present, this reflects on-disk corruption.\n\nsyzbot triggered this condition using a malformed NTFS image. During a\nrename() operation involving a long filename (which spans multiple\nindex entries), the empty bitmap allowed the name to be added without\nvalid tracking. Subsequent deletion of the original entry failed with\n-ENOENT, due to unexpected index state.\n\nReject such cases by verifying that the bitmap is not empty when index\nblocks exist."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfs/ntfs3: rechazar la asignación de índice si $BITMAP está vacío pero existen bloques\n\nLa asignación de índice requiere al menos un bit en el atributo $BITMAP para rastrear el uso de las entradas de índice. Si el mapa de bits está vacío mientras los bloques de índice ya están presentes, esto refleja corrupción en disco.\n\nsyzbot activó esta condición usando una imagen NTFS malformada. Durante una operación rename() que involucraba un nombre de archivo largo (que abarca múltiples entradas de índice), el mapa de bits vacío permitió que el nombre fuera añadido sin un seguimiento válido. La eliminación posterior de la entrada original falló con -ENOENT, debido a un estado de índice inesperado.\n\nRechazar tales casos verificando que el mapa de bits no esté vacío cuando existan bloques de índice."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/ntfs3/index.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "47856e10f8d5e066aa26b1f9c02d933fe0620399",
"lessThan": "aab2e34b139f6df71ab2b1adeec9927c206adc79",
"versionType": "git",
"status": "affected"
},
{
"version": "b35a50d639ca5259466ef5fea85529bb4fb17d5b",
"lessThan": "978aac54e93ea35aab20b32ae393d3d33964e7ae",
"versionType": "git",
"status": "affected"
},
{
"version": "3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc",
"lessThan": "be66551da203862c689c12e1d35ce87217c017c1",
"versionType": "git",
"status": "affected"
},
{
"version": "d99208b91933fd2a58ed9ed321af07dacd06ddc3",
"lessThan": "039ddf353cc33f6546a87ec1ac3210637d714bec",
"versionType": "git",
"status": "affected"
},
{
"version": "d99208b91933fd2a58ed9ed321af07dacd06ddc3",
"lessThan": "0dc7117da8f92dd5fe077d712a756eccbe377d40",
"versionType": "git",
"status": "affected"
},
{
"version": "358d4f821c03add421a4c49290538a705852ccf1",
"versionType": "git",
"status": "affected"
},
{
"version": "a285395020780adac1ffbc844069c3d700bf007a",
"versionType": "git",
"status": "affected"
},
{
"version": "6.6.102",
"lessThan": "6.6.112",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.12.42",
"lessThan": "6.12.53",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.15.10",
"lessThan": "6.16",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.16.1",
"lessThan": "6.17",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/ntfs3/index.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.17",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.17",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.112",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.53",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.3",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/039ddf353cc33f6546a87ec1ac3210637d714bec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0dc7117da8f92dd5fe077d712a756eccbe377d40",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/978aac54e93ea35aab20b32ae393d3d33964e7ae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/aab2e34b139f6df71ab2b1adeec9927c206adc79",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/be66551da203862c689c12e1d35ce87217c017c1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}