CVE-2025-40067

fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

State: Published
Severity: 7.8 High
Published: Oct 28, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption.

syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT, due to unexpected index state.

Reject such cases by verifying that the bitmap is not empty when index blocks exist.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	47856e10f8d5e066aa26b1f9c02d933fe0620399 to before aab2e34b139f6df71ab2b1adeec9927c206adc79Affected b35a50d639ca5259466ef5fea85529bb4fb17d5b to before 978aac54e93ea35aab20b32ae393d3d33964e7aeAffected 3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc to before be66551da203862c689c12e1d35ce87217c017c1Affected d99208b91933fd2a58ed9ed321af07dacd06ddc3 to before 039ddf353cc33f6546a87ec1ac3210637d714becAffected d99208b91933fd2a58ed9ed321af07dacd06ddc3 to before 0dc7117da8f92dd5fe077d712a756eccbe377d40Affected 358d4f821c03add421a4c49290538a705852ccf1Affected a285395020780adac1ffbc844069c3d700bf007aAffected 6.6.102 to before 6.6.112Affected 6.12.42 to before 6.12.53Affected 6.15.10 to before 6.16Affected 6.16.1 to before 6.17Affected
LinuxLinux	6.17Affected before 6.17Not affected 6.6.112 through 6.6.Not affected 6.12.53 through 6.12.Not affected 6.17.3 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

47856e10f8d5e066aa26b1f9c02d933fe0620399 to before aab2e34b139f6df71ab2b1adeec9927c206adc79Affected
b35a50d639ca5259466ef5fea85529bb4fb17d5b to before 978aac54e93ea35aab20b32ae393d3d33964e7aeAffected
3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc to before be66551da203862c689c12e1d35ce87217c017c1Affected
d99208b91933fd2a58ed9ed321af07dacd06ddc3 to before 039ddf353cc33f6546a87ec1ac3210637d714becAffected
d99208b91933fd2a58ed9ed321af07dacd06ddc3 to before 0dc7117da8f92dd5fe077d712a756eccbe377d40Affected
358d4f821c03add421a4c49290538a705852ccf1Affected
a285395020780adac1ffbc844069c3d700bf007aAffected
6.6.102 to before 6.6.112Affected
6.12.42 to before 6.12.53Affected
6.15.10 to before 6.16Affected
6.16.1 to before 6.17Affected

LinuxLinux

6.17Affected
before 6.17Not affected
6.6.112 through 6.6.*Not affected
6.12.53 through 6.12.*Not affected
6.17.3 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.