← Back to CVE Explorer

CVE-2025-40068

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in run_unpack() The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths showed that the values of the runlist array, from which LCNs are calculated, are not validated before run_unpack function. The run_unpack function decodes the compressed runlist data format from MFT attributes (for example, $DATA), converting them into a runs_tree structure, which describes the mapping of virtual clusters (VCN) to logical clusters (LCN). The NTFS3 subsystem also has a shortcut for deleting files from MFT records - in this case, the RUN_DEALLOCATE command is sent to the run_unpack input, and the function logic provides that all data transferred to the runlist about file or directory is deleted without creating a runs_tree structure. Substituting the runlist in the $DATA attribute of the MFT record for an arbitrary file can lead either to access to arbitrary data on the disk bypassing access checks to them (since the inode access check occurs above) or to destruction of arbitrary data on the disk. Add overflow check for addition operation. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Severity
HIGH
CVSS score
8.4 (v3.1)
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-28 12:15:41.277000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON 
{
  "id": "CVE-2025-40068",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-10-28T12:15:41.277",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: Fix integer overflow in run_unpack()\n\nThe MFT record relative to the file being opened contains its runlist,\nan array containing information about the file's location on the physical\ndisk. Analysis of all Call Stack paths showed that the values of the\nrunlist array, from which LCNs are calculated, are not validated before\nrun_unpack function.\n\nThe run_unpack function decodes the compressed runlist data format\nfrom MFT attributes (for example, $DATA), converting them into a runs_tree\nstructure, which describes the mapping of virtual clusters (VCN) to\nlogical clusters (LCN). The NTFS3 subsystem also has a shortcut for\ndeleting files from MFT records - in this case, the RUN_DEALLOCATE\ncommand is sent to the run_unpack input, and the function logic\nprovides that all data transferred to the runlist about file or\ndirectory is deleted without creating a runs_tree structure.\n\nSubstituting the runlist in the $DATA attribute of the MFT record for an\narbitrary file can lead either to access to arbitrary data on the disk\nbypassing access checks to them (since the inode access check\noccurs above) or to destruction of arbitrary data on the disk.\n\nAdd overflow check for addition operation.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfs: ntfs3: Corrección de desbordamiento de entero en run_unpack()\n\nEl registro MFT relativo al archivo que se está abriendo contiene su runlist, una matriz que contiene información sobre la ubicación del archivo en el disco físico. El análisis de todas las rutas de la pila de llamadas (Call Stack) mostró que los valores de la matriz runlist, a partir de los cuales se calculan los LCN, no se validan antes de la función run_unpack.\n\nLa función run_unpack decodifica el formato de datos runlist comprimido de los atributos MFT (por ejemplo, $DATA), convirtiéndolos en una estructura runs_tree, que describe el mapeo de clústeres virtuales (VCN) a clústeres lógicos (LCN). El subsistema NTFS3 también tiene un atajo para eliminar archivos de los registros MFT; en este caso, el comando RUN_DEALLOCATE se envía a la entrada de run_unpack, y la lógica de la función establece que todos los datos transferidos al runlist sobre el archivo o directorio se eliminan sin crear una estructura runs_tree.\n\nSustituir el runlist en el atributo $DATA del registro MFT para un archivo arbitrario puede llevar a acceder a datos arbitrarios en el disco, eludiendo las comprobaciones de acceso a los mismos (ya que la comprobación de acceso del inodo ocurre antes) o a la destrucción de datos arbitrarios en el disco.\n\nAñadir comprobación de desbordamiento para la operación de adición.\n\nEncontrado por Linux Verification Center (linuxtesting.org) con SVACE."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/ntfs3/run.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "lessThan": "f6b36cfd25cbadad63447c673743cf771090e756",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "lessThan": "3ac37e100385b59ac821a62118494442238aaac4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "lessThan": "a86c8b9d03f7101e1750233846fe989df6f0d631",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "lessThan": "9378cfe228c2c679564a4116bcb28c8e89dff989",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "lessThan": "5aa5799d162ad1b8e8b699d48b6218143c695a78",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "lessThan": "736fc7bf5f68f6b74a0925b7e072c571838657d2",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/ntfs3/run.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.15",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.15",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.195",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.156",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.112",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.53",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.3",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3ac37e100385b59ac821a62118494442238aaac4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5aa5799d162ad1b8e8b699d48b6218143c695a78",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/736fc7bf5f68f6b74a0925b7e072c571838657d2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9378cfe228c2c679564a4116bcb28c8e89dff989",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a86c8b9d03f7101e1750233846fe989df6f0d631",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f6b36cfd25cbadad63447c673743cf771090e756",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}