Executive brief
A vulnerability in the Linux kernel's NTFS file system driver could allow a system crash or data corruption when processing a specially crafted disk image. The issue occurs when the system attempts to manage files on a corrupted NTFS drive where internal tracking data (bitmaps) does not match the actual file structure. An attacker could exploit this by tricking a user or system into mounting a malicious NTFS image, potentially leading to a full system compromise or loss of data integrity.
Technical details
A vulnerability exists in the fs/ntfs3/index.c component of the Linux kernel's NTFS3 driver. The issue arises when an NTFS index allocation occurs on a volume where the $BITMAP attribute is empty but index blocks already exist, indicating on-disk corruption. An attacker can trigger this by providing a malformed NTFS image; during operations like rename() involving long filenames, the driver may add entries without valid tracking, leading to an inconsistent state and subsequent failures (e.g., -ENOENT during deletion). This can be exploited via a local attack vector requiring user interaction (mounting a malicious image) to achieve code execution or denial of service. Patches have been released across multiple stable kernel branches to verify that the bitmap is not empty when index blocks exist.
Affected products
- Linux Linux Kernel 6.6.102 to 6.6.112, 6.12.42 to 6.12.53, 6.15.10 to 6.16, 6.16.1 to 6.17, 6.17 to 6.17.3
Timeline
- 2025-07-22: other: Vulnerability fixed in source code
- 2025-10-28: advisory: CVE-2025-40067 published