Linux Kernel CVE-2025-40067

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption.

syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT, due to unexpected index state.

Reject such cases by verifying that the bitmap is not empty when index blocks exist.

The vulnerability is in the Linux kernel's ntfs3 driver (fs/ntfs3). No CPE strings were provided in the input, so exact affected version ranges are not enumerated here; the four git.kernel.org stable-tree fix commits (039ddf353cc3, 0dc7117da8f9, 978aac54e93e, be66551da203) indicate the fix was backported across multiple stable branches, implying multiple maintained kernel series are affected prior to those commits. Any Linux distribution kernel that ships and enables the CONFIG_NTFS3_FS driver and permits mounting untrusted NTFS volumes should be considered affected until updated. See the upstream commit references at https://git.kernel.org/stable/c/be66551da203862c689c12e1d35ce87217c017c1 and the related stable commits.