CVE-2025-40067: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption.
syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT, due to unexpected index state.
Reject such cases by verifying that the bitmap is not empty when index blocks exist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.57-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.17.6-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.17.3 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40067?
CVE-2025-40067 has been classified with a severity level that indicates potential risk to the Linux kernel's file system integrity.
How do I fix CVE-2025-40067?
The fix for CVE-2025-40067 involves updating the Linux kernel to a version that includes the resolution for this vulnerability.
What systems are affected by CVE-2025-40067?
CVE-2025-40067 affects systems running vulnerable versions of the Linux kernel that utilize NTFS3 file system.
What are the potential impacts of CVE-2025-40067?
The potential impacts of CVE-2025-40067 include file system corruption and data loss due to improper index allocation.
How can I verify if my system is vulnerable to CVE-2025-40067?
You can verify vulnerability to CVE-2025-40067 by checking your running Linux kernel version and comparing it with patched releases.