CVE-2025-38692

exfat: add cluster chain loop check for dir

State: Published
Severity: Not scored
Published: Sep 4, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

exfat: add cluster chain loop check for dir

An infinite loop may occur if the following conditions occur due to file system corruption.

(1) Condition for exfat_count_dir_entries() to loop infinitely. - The cluster chain includes a loop. - There is no UNUSED entry in the cluster chain.

(2) Condition for exfat_create_upcase_table() to loop infinitely. - The cluster chain of the root directory includes a loop. - There are no UNUSED entry and up-case table entry in the cluster chain of the root directory.

(3) Condition for exfat_load_bitmap() to loop infinitely. - The cluster chain of the root directory includes a loop. - There are no UNUSED entry and bitmap entry in the cluster chain of the root directory.

(4) Condition for exfat_find_dir_entry() to loop infinitely. - The cluster chain includes a loop. - The unused directory entries were exhausted by some operation.

(5) Condition for exfat_check_dir_empty() to loop infinitely. - The cluster chain includes a loop. - The unused directory entries were exhausted by some operation. - All files and sub-directories under the directory are deleted.

This commit adds checks to break the above infinite loop.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 1715f0996f7baf817c73613aeda500c4f73a6bd6Affected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 868f23286c1a13162330fa6c614fe350f78e3f82Affected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before aa8fe7b7b73d4c9a41bb96cb3fb3092f794ecb33Affected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before e2066ca3ef49a30920d8536fa366b2a183a808eeAffected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 4c3cda20c4cf1871e27868d08fda06b79bc7d568Affected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 99f9a97dce39ad413c39b92c90393bbd6778f3fdAffected
LinuxLinux	5.7Affected before 5.7Not affected 6.1.191 through 6.1.Not affected 6.6.103 through 6.6.Not affected 6.12.43 through 6.12.Not affected 6.15.11 through 6.15.Not affected 6.16.2 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 1715f0996f7baf817c73613aeda500c4f73a6bd6Affected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 868f23286c1a13162330fa6c614fe350f78e3f82Affected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before aa8fe7b7b73d4c9a41bb96cb3fb3092f794ecb33Affected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before e2066ca3ef49a30920d8536fa366b2a183a808eeAffected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 4c3cda20c4cf1871e27868d08fda06b79bc7d568Affected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 99f9a97dce39ad413c39b92c90393bbd6778f3fdAffected

LinuxLinux

5.7Affected
before 5.7Not affected
6.1.191 through 6.1.*Not affected
6.6.103 through 6.6.*Not affected
6.12.43 through 6.12.*Not affected
6.15.11 through 6.15.*Not affected
6.16.2 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.