Executive brief
A vulnerability in the Linux kernel's exFAT file system driver can allow a local user to cause a system hang. By using a specially crafted or corrupted exFAT storage device, an attacker can trigger an infinite loop that prevents the system from completing file operations. This results in a denial-of-service where other tasks waiting for file system access will stop responding.
Technical details
A vulnerability exists in the exfat_readdir() function of the Linux kernel's exFAT implementation (CWE-835). When a file system is corrupted such that a cluster is linked to itself (forming a circular chain) and contains an unused directory entry, the 'dentry' counter is not incremented. This prevents the 'dentry < max_dentries' exit condition from being met, resulting in an infinite loop while holding the 's_lock' mutex. A local attacker with the ability to mount or access a crafted exFAT volume can trigger this loop, causing a kernel hang and denial of service for any other tasks attempting to synchronize or access the file system. The issue has been patched in various stable kernel branches by ensuring the cluster chain traversal stops upon encountering an unused directory entry.
Affected products
- Linux Linux Kernel 5.7 to 6.1.125, 6.2 to 6.6.72, 6.7 to 6.12.10, 6.13-rc1 to 6.13-rc6
Timeline
- 2025-01-21: disclosed
- 2025-01-21: advisory
References
- https://git.kernel.org/stable/c/28c21f0ac5293a4bf19b3e0e32005d6dd31a6c17
- https://git.kernel.org/stable/c/31beabd0f47f8c3ed9965ba861c9e5b252d4920a
- https://git.kernel.org/stable/c/d8cfbb8723bd3d3222f360227a1cc15227189ca6
- https://git.kernel.org/stable/c/d9ea94f5cd117d56e573696d0045ab3044185a15
- https://git.kernel.org/stable/c/dc1d7afceb982e8f666e70a582e6b5aa806de063
- https://git.kernel.org/stable/c/fee873761bd978d077d8c55334b4966ac4cb7b59
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html