CVE-2025-40307

Katalog CVE

CVSS 7.8 · High EPSS 0,15%

Skor CVSS 3.1 7.8 (High) menurut CNA.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use.

Rincian

Terbit di NVD

8 Desember 2025

Terakhir diubah

19 Agustus 2026

Status NVD

Deferred

CVSS 3.1

7.8 (High), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf
• https://git.kernel.org/stable/c/67ce8034dc0278ddd88cad93d4218a945180dddd
• https://git.kernel.org/stable/c/6bc58b4c53795ab5fe00648344aa7d9d61175f90
• https://git.kernel.org/stable/c/79c1587b6cda74deb0c86fc7ba194b92958c793c
• https://git.kernel.org/stable/c/87f827d53bd0688597bda63ae95908e2ad39bac0