CVE-2025-40307 (GCVE-0-2025-40307)

Vulnerability from cvelistv5 – Published: 2025-12-08 00:46 – Updated: 2026-10-15 22:02
VLAI
Title
exfat: validate cluster allocation bits of the allocation bitmap
Summary
In the Linux kernel, the following vulnerability has been resolved: exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:59 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6637 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 , < 87f827d53bd0688597bda63ae95908e2ad39bac0 (git)
Affected: 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 , < 67ce8034dc0278ddd88cad93d4218a945180dddd (git)
Affected: 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 , < 6bc58b4c53795ab5fe00648344aa7d9d61175f90 (git)
Affected: 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 , < 13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf (git)
Affected: 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 , < 79c1587b6cda74deb0c86fc7ba194b92958c793c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.58 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40307",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:59:01.153133Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:43.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/exfat/balloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87f827d53bd0688597bda63ae95908e2ad39bac0",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            },
            {
              "lessThan": "67ce8034dc0278ddd88cad93d4218a945180dddd",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            },
            {
              "lessThan": "6bc58b4c53795ab5fe00648344aa7d9d61175f90",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            },
            {
              "lessThan": "13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            },
            {
              "lessThan": "79c1587b6cda74deb0c86fc7ba194b92958c793c",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/exfat/balloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: validate cluster allocation bits of the allocation bitmap\n\nsyzbot created an exfat image with cluster bits not set for the allocation\nbitmap. exfat-fs reads and uses the allocation bitmap without checking\nthis. The problem is that if the start cluster of the allocation bitmap\nis 6, cluster 6 can be allocated when creating a directory with mkdir.\nexfat zeros out this cluster in exfat_mkdir, which can delete existing\nentries. This can reallocate the allocated entries. In addition,\nthe allocation bitmap is also zeroed out, so cluster 6 can be reallocated.\nThis patch adds exfat_test_bitmap_range to validate that clusters used for\nthe allocation bitmap are correctly marked as in-use."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached by getting a crafted exFAT image mounted from a local block device, loop file, or removable medium and then issuing a local `mkdir()`; there is no network consumer of `exfat_allocate_bitmap()`.\nAC:L - The attacker fully controls the image: clearing the bitmap\u0027s own allocation bit and pointing `start_clu` at a low cluster makes `exfat_find_free_bitmap()` deterministically return that cluster on the very first allocation, so a single `mkdir` reliably zeroes the live bitmap with no race, heap shaping, or memory-layout dependency.\nPR:L - Direct `mount()` needs CAP_SYS_ADMIN, but ubiquitous privileged mount brokers (udisks2, systemd-mount, autofs, Android vold) let an unprivileged local user get an attacker-supplied exFAT volume or loop image mounted rw, after which any user with write access to the mount can run the triggering `mkdir`.\nUI:N - The attacker requests the mount through the automount broker and runs `mkdir` themselves; on a kiosk or shared workstation inserting their own exFAT stick achieves the same, with no action required from any other user or administrator.\nS:U - The corruption and its consequences are confined to the kernel and filesystem that own the mount; no VM, IOMMU, container, or other security-authority boundary is crossed.\nC:H - Once the bitmap is zeroed the allocator re-hands out clusters that are still live, so a newly created file is backed by clusters holding the root directory, other files\u0027 data, and the allocation bitmap itself \u2014 reading that file discloses their full contents, an unbounded read of co-resident data on the shared volume rather than a small bounded leak.\nI:H - This is the core defect: the kernel zeroes and overwrites in-use on-disk metadata (\"can delete existing entries\") and reallocates already-allocated clusters, so attacker-controlled file writes land directly in directory entries and in the live in-kernel allocation bitmap, giving unbounded modification of structures the filesystem subsequently trusts.\nA:H - The zeroed bitmap makes every `exfat_clear_bitmap()` fail with `-EIO`, desyncs `used_clusters` into `exfat_fs_error_ratelimit()`, and produces aliased/looping cluster chains that yield task hangs and the syzbot-reported deadlock WARNING; with `errors=panic`, `panic_on_warn`, or `panic_on_oops` this is a full panic, and the volume is left permanently unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:27:52.404Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87f827d53bd0688597bda63ae95908e2ad39bac0"
        },
        {
          "url": "https://git.kernel.org/stable/c/67ce8034dc0278ddd88cad93d4218a945180dddd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bc58b4c53795ab5fe00648344aa7d9d61175f90"
        },
        {
          "url": "https://git.kernel.org/stable/c/13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/79c1587b6cda74deb0c86fc7ba194b92958c793c"
        }
      ],
      "title": "exfat: validate cluster allocation bits of the allocation bitmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40307",
    "datePublished": "2025-12-08T00:46:32.659Z",
    "dateReserved": "2025-04-16T07:20:57.185Z",
    "dateUpdated": "2026-10-15T22:02:43.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40307",
      "date": "2026-11-04",
      "epss": "0.00147",
      "percentile": "0.03916"
    },
    "microsoft_vex": {
      "current_release_date": "2025-12-09T01:01:26.000Z",
      "cve": "CVE-2025-40307",
      "id": "msrc_CVE-2025-40307",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "exfat: validate cluster allocation bits of the allocation bitmap",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40307.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/exfat/balloc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "87f827d53bd0688597bda63ae95908e2ad39bac0",
                    "status": "affected",
                    "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "67ce8034dc0278ddd88cad93d4218a945180dddd",
                    "status": "affected",
                    "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6bc58b4c53795ab5fe00648344aa7d9d61175f90",
                    "status": "affected",
                    "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf",
                    "status": "affected",
                    "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "79c1587b6cda74deb0c86fc7ba194b92958c793c",
                    "status": "affected",
                    "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/exfat/balloc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.7"
                  },
                  {
                    "lessThan": "5.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.58",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: validate cluster allocation bits of the allocation bitmap\n\nsyzbot created an exfat image with cluster bits not set for the allocation\nbitmap. exfat-fs reads and uses the allocation bitmap without checking\nthis. The problem is that if the start cluster of the allocation bitmap\nis 6, cluster 6 can be allocated when creating a directory with mkdir.\nexfat zeros out this cluster in exfat_mkdir, which can delete existing\nentries. This can reallocate the allocated entries. In addition,\nthe allocation bitmap is also zeroed out, so cluster 6 can be reallocated.\nThis patch adds exfat_test_bitmap_range to validate that clusters used for\nthe allocation bitmap are correctly marked as in-use."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nexfat: validar los bits de asignaci\u00f3n de cl\u00faster del mapa de bits de asignaci\u00f3n\n\nsyzbot cre\u00f3 una imagen exfat con bits de cl\u00faster no establecidos para el mapa de bits de asignaci\u00f3n. exfat-fs lee y utiliza el mapa de bits de asignaci\u00f3n sin comprobar esto. El problema es que si el cl\u00faster de inicio del mapa de bits de asignaci\u00f3n es 6, el cl\u00faster 6 puede ser asignado al crear un directorio con mkdir. exfat pone a cero este cl\u00faster en exfat_mkdir, lo que puede eliminar entradas existentes. Esto puede reasignar las entradas asignadas. Adem\u00e1s, el mapa de bits de asignaci\u00f3n tambi\u00e9n se pone a cero, por lo que el cl\u00faster 6 puede ser reasignado. Este parche a\u00f1ade exfat_test_bitmap_range para validar que los cl\u00fasteres utilizados para el mapa de bits de asignaci\u00f3n est\u00e1n correctamente marcados como en uso."
          }
        ],
        "id": "CVE-2025-40307",
        "lastModified": "2026-10-15T22:19:07.553",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-40307",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:59:01.153133Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-08T01:16:02.950",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/67ce8034dc0278ddd88cad93d4218a945180dddd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6bc58b4c53795ab5fe00648344aa7d9d61175f90"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/79c1587b6cda74deb0c86fc7ba194b92958c793c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/87f827d53bd0688597bda63ae95908e2ad39bac0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:43:07+00:00",
      "cve": "CVE-2025-40307",
      "id": "CVE-2025-40307",
      "initial_release_date": "2025-12-08T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: exfat: validate cluster allocation bits of the allocation bitmap",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40307.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.