Riskcovery

CVE-2025-40287

exfat: fix improper check of dentry.stream.valid_size

State
Published
Severity
Not scored
Published
Dec 6, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix improper check of dentry.stream.valid_size

We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is malformed, the following system calls — SYS_openat, SYS_ftruncate, and SYS_pwrite64 — can cause the kernel to hang.

Root cause analysis shows that the size validation code in exfat_find() does not check whether dentry.stream.valid_size is negative. As a result, the system calls mentioned above can succeed and eventually trigger the DoS issue.

This patch adds a check for negative dentry.stream.valid_size to prevent this vulnerability.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 11a347fb6cef62ce47e84b97c45f2b2497c7593b to before 6c627bcc1896ba62ec793d0c00da74f3c93ce3adAffected
  • 11a347fb6cef62ce47e84b97c45f2b2497c7593b to before 204b1b02ee018ba52ad2ece21fe3a8643d66a1b2Affected
  • 11a347fb6cef62ce47e84b97c45f2b2497c7593b to before 82ebecdc74ff555daf70b811d854b1f32a296beaAffected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.12.59 through 6.12.*Not affected
  • 6.17.9 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.