CVE-2025-40067 Details
Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption. syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT, due to unexpected index state. Reject such cases by verifying that the bitmap is not empty when index blocks exist.
A vulnerability in the Linux kernel's NTFS3 file system handling has been addressed. The issue arose because index allocation requires at least one bit in the $BITMAP attribute to track the usage of index entries. If the bitmap is empty while index blocks are present, it indicates on-disk corruption. This condition was triggered by syzbot using a malformed NTFS image. During a rename operation with a long filename, the empty bitmap allowed the name to be added without proper tracking. As a result, deleting the original entry failed due to an unexpected index state. The vulnerability has been fixed by ensuring that the bitmap is not empty when index blocks exist.
Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/039ddf353cc33f6546a87ec1ac3210637d714bec | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/0dc7117da8f92dd5fe077d712a756eccbe377d40 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/978aac54e93ea35aab20b32ae393d3d33964e7ae | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/be66551da203862c689c12e1d35ce87217c017c1 | kernel.org | Source CodeVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Oct 28, 2025 | New CVE Received | kernel.org |