Executive brief
A vulnerability in the Linux kernel's exFAT file system driver could allow a local user to cause data corruption or system instability. By using a specially crafted storage device or disk image, the system may accidentally overwrite its own internal file tracking data. This can lead to the deletion of existing files or the corruption of the file system structure itself.
Technical details
A vulnerability exists in the Linux kernel exFAT file system driver (fs/exfat/balloc.c) where the driver fails to validate that the clusters used for the allocation bitmap itself are marked as in-use within that bitmap. An attacker can provide a malformed exFAT image where the allocation bitmap's own clusters are marked as free. When the kernel performs operations like 'mkdir', it may allocate these clusters, zero them out, and subsequently overwrite existing directory entries or the allocation bitmap itself. This is a local attack vector requiring the ability to mount a crafted filesystem. The fix introduces 'exfat_test_bitmap_range' to ensure bitmap clusters are correctly flagged as occupied during mount.
Affected products
- Linux Linux Kernel 5.7 to 6.12.57, 6.17.7
Timeline
- 2025-12-08: advisory
- 2025-11-13: patched