CVE Database
/

CVE-2025-40067

Back to search

CVE-2025-40067

Published: Oct 28, 2025

Modified: May 23, 2026

PUBLISHED

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption. syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT, due to unexpected index state. Reject such cases by verifying that the bitmap is not empty when index blocks exist.

VendorProductVersions

Linux

Linux

affected
b35a50d639ca5259466ef5fea85529bb4fb17d5b - < 978aac54e93ea35aab20b32ae393d3d33964e7ae
affected
3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc - < be66551da203862c689c12e1d35ce87217c017c1
affected
d99208b91933fd2a58ed9ed321af07dacd06ddc3 - < 039ddf353cc33f6546a87ec1ac3210637d714bec
affected
d99208b91933fd2a58ed9ed321af07dacd06ddc3 - < 0dc7117da8f92dd5fe077d712a756eccbe377d40
affected
358d4f821c03add421a4c49290538a705852ccf1

+5 more versions

Linux

Linux

affected
6.17
unaffected
0 - < 6.17
unaffected
6.6.112 - <= 6.6.*
unaffected
6.12.53 - <= 6.12.*
unaffected
6.17.3 - <= 6.17.*

+1 more versions

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now