CVE-2025-38615

fs/ntfs3: cancle set bad inode after removing name fails

State: Published
Severity: 7.8 High
Published: Aug 19, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: cancle set bad inode after removing name fails

The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted.

The underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier". In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call make_bad_inode() on it just for shits and giggles".

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	78ab59fee07f22464f32eafebab2bd97ba94ff2d to before 47856e10f8d5e066aa26b1f9c02d933fe0620399Affected 78ab59fee07f22464f32eafebab2bd97ba94ff2d to before b35a50d639ca5259466ef5fea85529bb4fb17d5bAffected 78ab59fee07f22464f32eafebab2bd97ba94ff2d to before 3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dccAffected 78ab59fee07f22464f32eafebab2bd97ba94ff2d to before 358d4f821c03add421a4c49290538a705852ccf1Affected 78ab59fee07f22464f32eafebab2bd97ba94ff2d to before a285395020780adac1ffbc844069c3d700bf007aAffected 78ab59fee07f22464f32eafebab2bd97ba94ff2d to before d99208b91933fd2a58ed9ed321af07dacd06ddc3Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.191 through 6.1.Not affected 6.6.102 through 6.6.Not affected 6.12.42 through 6.12.Not affected 6.15.10 through 6.15.Not affected 6.16.1 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

78ab59fee07f22464f32eafebab2bd97ba94ff2d to before 47856e10f8d5e066aa26b1f9c02d933fe0620399Affected
78ab59fee07f22464f32eafebab2bd97ba94ff2d to before b35a50d639ca5259466ef5fea85529bb4fb17d5bAffected
78ab59fee07f22464f32eafebab2bd97ba94ff2d to before 3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dccAffected
78ab59fee07f22464f32eafebab2bd97ba94ff2d to before 358d4f821c03add421a4c49290538a705852ccf1Affected
78ab59fee07f22464f32eafebab2bd97ba94ff2d to before a285395020780adac1ffbc844069c3d700bf007aAffected
78ab59fee07f22464f32eafebab2bd97ba94ff2d to before d99208b91933fd2a58ed9ed321af07dacd06ddc3Affected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.191 through 6.1.*Not affected
6.6.102 through 6.6.*Not affected
6.12.42 through 6.12.*Not affected
6.15.10 through 6.15.*Not affected
6.16.1 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.