Executive brief
A vulnerability in the Linux kernel's NTFS3 file system driver could allow an attacker to bypass security checks or corrupt data. The issue occurs when the system processes specially crafted file metadata (MFT records) that describe where data is stored on the physical disk. If exploited, this could lead to unauthorized access to sensitive files or the permanent destruction of data on the storage drive.
Technical details
An integer overflow vulnerability exists in the 'run_unpack' function within the 'fs/ntfs3/run.c' component of the Linux kernel. The root cause is a lack of validation for values in the runlist array—which maps virtual clusters (VCN) to logical clusters (LCN)—before they are processed. By substituting a malicious runlist in the $DATA attribute of an MFT record, an attacker can trigger an overflow during LCN calculation. This allows for bypassing inode access checks to read arbitrary disk data or causing the destruction of arbitrary data via the RUN_DEALLOCATE command. The issue has been patched by introducing 'check_add_overflow' calls in the affected code paths.
Affected products
- Linux Linux Kernel 5.15 to 6.17.3
Timeline
- 2025-08-25: other: Patch authored
- 2025-10-28: advisory: CVE-2025-40068 published
References
- https://git.kernel.org/stable/c/3ac37e100385b59ac821a62118494442238aaac4
- https://git.kernel.org/stable/c/5aa5799d162ad1b8e8b699d48b6218143c695a78
- https://git.kernel.org/stable/c/736fc7bf5f68f6b74a0925b7e072c571838657d2
- https://git.kernel.org/stable/c/9378cfe228c2c679564a4116bcb28c8e89dff989
- https://git.kernel.org/stable/c/a86c8b9d03f7101e1750233846fe989df6f0d631
- https://git.kernel.org/stable/c/f6b36cfd25cbadad63447c673743cf771090e756