CVE-2025-38615 (GCVE-0-2025-38615)

Vulnerability from cvelistv5 – Published: 2025-08-19 17:03 – Updated: 2026-08-05 12:03
VLAI
Title
fs/ntfs3: cancle set bad inode after removing name fails
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: cancle set bad inode after removing name fails The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted. The underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier". In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call make_bad_inode() on it just for shits and giggles".
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 78ab59fee07f22464f32eafebab2bd97ba94ff2d , < b35a50d639ca5259466ef5fea85529bb4fb17d5b (git)
Affected: 78ab59fee07f22464f32eafebab2bd97ba94ff2d , < 3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc (git)
Affected: 78ab59fee07f22464f32eafebab2bd97ba94ff2d , < 358d4f821c03add421a4c49290538a705852ccf1 (git)
Affected: 78ab59fee07f22464f32eafebab2bd97ba94ff2d , < a285395020780adac1ffbc844069c3d700bf007a (git)
Affected: 78ab59fee07f22464f32eafebab2bd97ba94ff2d , < d99208b91933fd2a58ed9ed321af07dacd06ddc3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.6.102 , ≤ 6.6.* (semver)
Unaffected: 6.12.42 , ≤ 6.12.* (semver)
Unaffected: 6.15.10 , ≤ 6.15.* (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/frecord.c",
            "fs/ntfs3/namei.c",
            "fs/ntfs3/ntfs_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b35a50d639ca5259466ef5fea85529bb4fb17d5b",
              "status": "affected",
              "version": "78ab59fee07f22464f32eafebab2bd97ba94ff2d",
              "versionType": "git"
            },
            {
              "lessThan": "3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc",
              "status": "affected",
              "version": "78ab59fee07f22464f32eafebab2bd97ba94ff2d",
              "versionType": "git"
            },
            {
              "lessThan": "358d4f821c03add421a4c49290538a705852ccf1",
              "status": "affected",
              "version": "78ab59fee07f22464f32eafebab2bd97ba94ff2d",
              "versionType": "git"
            },
            {
              "lessThan": "a285395020780adac1ffbc844069c3d700bf007a",
              "status": "affected",
              "version": "78ab59fee07f22464f32eafebab2bd97ba94ff2d",
              "versionType": "git"
            },
            {
              "lessThan": "d99208b91933fd2a58ed9ed321af07dacd06ddc3",
              "status": "affected",
              "version": "78ab59fee07f22464f32eafebab2bd97ba94ff2d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/frecord.c",
            "fs/ntfs3/namei.c",
            "fs/ntfs3/ntfs_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: cancle set bad inode after removing name fails\n\nThe reproducer uses a file0 on a ntfs3 file system with a corrupted i_link.\nWhen renaming, the file0\u0027s inode is marked as a bad inode because the file\nname cannot be deleted.\n\nThe underlying bug is that make_bad_inode() is called on a live inode.\nIn some cases it\u0027s \"icache lookup finds a normal inode, d_splice_alias()\nis called to attach it to dentry, while another thread decides to call\nmake_bad_inode() on it - that would evict it from icache, but we\u0027d already\nfound it there earlier\".\nIn some it\u0027s outright \"we have an inode attached to dentry - that\u0027s how we\ngot it in the first place; let\u0027s call make_bad_inode() on it just for shits\nand giggles\"."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached purely through local syscalls \u2014 `renameat2()` on a mounted ntfs3 volume followed by `openat()` on the affected path; there is no remote or network-facing consumer of this code.\nAC:L - The attacker crafts the NTFS image so `ni_remove_name()` deterministically fails, and drives both sides of the `d_splice_alias()`/`make_bad_inode()` window with its own threads (a rename loop plus a lookup/open loop), so no condition lies outside its control; the downstream `S_ISDIR` bypass and inode-unhashing consequences need no race at all.\nPR:L - Renaming and opening files on a mounted ntfs3 volume are ordinary unprivileged operations, and ntfs3 mounts default to permissive uid/gid/fmask/dmask permissions; the mount itself is obtained without any elevated credentials via udisks2 loop-setup/filesystem-mount, which are granted to active local sessions by default.\nUI:N - The attacker performs every step alone \u2014 supplying the crafted image, mounting it through udisks2 or removable-media auto-mount, then issuing the rename and open; no action by any other user is required.\nS:U - The wild-pointer dereference and inode/dcache state corruption occur entirely within the kernel\u0027s own security authority, crossing no VM, IOMMU, or sandbox boundary.\nC:H - `pick_link()` dereferences `inode-\u003ei_link`, which actually holds `i_dir_seq` \u2014 a value the attacker inflates by adding directory entries \u2014 and consumes the target bytes as a symlink body steering path resolution, so on configurations without SMAP/PAN this yields an attacker-directed read primitive; the duplicate-inode aliasing additionally cross-links clusters between unrelated files.\nI:H - The corrupted symlink body redirects path resolution to attacker-chosen targets, the `S_IFDIR\u2192S_IFREG` flip bypasses the non-empty-directory guard in `ntfs_unlink_inode()` allowing live directories to be unlinked, and duplicate `ntfs_inode`s for one MFT record double-free clusters \u2014 a memory- and metadata-corruption primitive steerable toward control-flow hijack.\nA:H - syzbot reproduced a general protection fault / KASAN null-ptr-deref in `pick_link()` from `do_sys_openat2()`, and the unhashed live inode plus `ni-\u003edir`/`ni-\u003efile` union confusion produce further oopses \u2014 any of which panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:30.645Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b35a50d639ca5259466ef5fea85529bb4fb17d5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/358d4f821c03add421a4c49290538a705852ccf1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a285395020780adac1ffbc844069c3d700bf007a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d99208b91933fd2a58ed9ed321af07dacd06ddc3"
        }
      ],
      "title": "fs/ntfs3: cancle set bad inode after removing name fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38615",
    "datePublished": "2025-08-19T17:03:57.164Z",
    "dateReserved": "2025-04-16T04:51:24.029Z",
    "dateUpdated": "2026-08-05T12:03:30.645Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38615",
      "date": "2026-09-20",
      "epss": "0.00168",
      "percentile": "0.06455"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/frecord.c",
                  "fs/ntfs3/namei.c",
                  "fs/ntfs3/ntfs_fs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b35a50d639ca5259466ef5fea85529bb4fb17d5b",
                    "status": "affected",
                    "version": "78ab59fee07f22464f32eafebab2bd97ba94ff2d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc",
                    "status": "affected",
                    "version": "78ab59fee07f22464f32eafebab2bd97ba94ff2d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "358d4f821c03add421a4c49290538a705852ccf1",
                    "status": "affected",
                    "version": "78ab59fee07f22464f32eafebab2bd97ba94ff2d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a285395020780adac1ffbc844069c3d700bf007a",
                    "status": "affected",
                    "version": "78ab59fee07f22464f32eafebab2bd97ba94ff2d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d99208b91933fd2a58ed9ed321af07dacd06ddc3",
                    "status": "affected",
                    "version": "78ab59fee07f22464f32eafebab2bd97ba94ff2d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/frecord.c",
                  "fs/ntfs3/namei.c",
                  "fs/ntfs3/ntfs_fs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.102",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "919A85C7-06DA-441A-8557-8A384BBB3F7E",
                    "versionEndExcluding": "6.6.102",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EA7AA5E6-4376-4A85-A021-6ACC5FF801C3",
                    "versionEndExcluding": "6.12.42",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5890C690-B295-40C2-9121-FF5F987E5142",
                    "versionEndExcluding": "6.15.10",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "58182352-D7DF-4CC9-841E-03C1D852C3FB",
                    "versionEndExcluding": "6.16.1",
                    "versionStartIncluding": "6.16",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: cancle set bad inode after removing name fails\n\nThe reproducer uses a file0 on a ntfs3 file system with a corrupted i_link.\nWhen renaming, the file0\u0027s inode is marked as a bad inode because the file\nname cannot be deleted.\n\nThe underlying bug is that make_bad_inode() is called on a live inode.\nIn some cases it\u0027s \"icache lookup finds a normal inode, d_splice_alias()\nis called to attach it to dentry, while another thread decides to call\nmake_bad_inode() on it - that would evict it from icache, but we\u0027d already\nfound it there earlier\".\nIn some it\u0027s outright \"we have an inode attached to dentry - that\u0027s how we\ngot it in the first place; let\u0027s call make_bad_inode() on it just for shits\nand giggles\"."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/ntfs3: falla la cancelaci\u00f3n de un inodo err\u00f3neo tras eliminar el nombre. El reproductor usa un archivo \"file0\" en un sistema de archivos ntfs3 con un i_link da\u00f1ado. Al renombrar, el inodo de archivo \"file0\" se marca como err\u00f3neo porque no se puede eliminar el nombre del archivo. El error subyacente radica en que se llama a make_bad_inode() en un inodo activo. En algunos casos, la b\u00fasqueda de icache encuentra un inodo normal, se llama a d_splice_alias() para asociarlo a dentry, mientras que otro hilo decide llamar a make_bad_inode() en \u00e9l; eso lo expulsar\u00eda de icache, pero ya lo hab\u00edamos encontrado all\u00ed anteriormente. En otros casos, es simplemente: \"Tenemos un inodo asociado a dentry; as\u00ed es como lo obtuvimos; llamemos a make_bad_inode() en \u00e9l, solo por diversi\u00f3n\"."
          }
        ],
        "id": "CVE-2025-38615",
        "lastModified": "2026-07-30T06:23:30.920",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-08-19T17:15:40.177",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/358d4f821c03add421a4c49290538a705852ccf1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a285395020780adac1ffbc844069c3d700bf007a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b35a50d639ca5259466ef5fea85529bb4fb17d5b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d99208b91933fd2a58ed9ed321af07dacd06ddc3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:22:47+00:00",
      "cve": "CVE-2025-38615",
      "id": "CVE-2025-38615",
      "initial_release_date": "2025-08-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/ntfs3: cancle set bad inode after removing name fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38615.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.