Skip to main content

Linux Kernel CVE-2025-40307

| EUVDEUVD-2025-201638 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local mount of a crafted image (AV:L, PR:L for mount capability); on-disk corruption and stale-cluster reuse yield high integrity, availability and confidentiality impact within the same system (S:U).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.3 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201638
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.8
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

exfat: validate cluster allocation bits of the allocation bitmap

syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use.

AnalysisAI

Filesystem corruption in the Linux kernel's exFAT driver (exfat-fs) allows a local attacker who can mount a crafted exFAT image to overwrite in-use data structures and reallocate live clusters. Because the allocation bitmap's own cluster-allocation bits are never validated on mount, a malicious image can point the bitmap at cluster 6, which mkdir then zeroes - deleting existing directory entries and corrupting the bitmap itself, enabling further reallocation of already-allocated clusters. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), consistent with a local physical/mount-dependent flaw rather than a mass-exploited network bug.

Technical ContextAI

The bug is in fs/exfat, the in-kernel driver implementing Microsoft's exFAT filesystem used on SD cards, USB flash media and other removable storage. exFAT tracks free/used clusters with an allocation bitmap that itself occupies one or more clusters on disk. On mount, exfat-fs trusts the bitmap's declared start cluster and reads it without verifying that those clusters are marked in-use within the bitmap. This is a missing-input-validation class defect (CWE-20 / CWE-1284, improper validation of an on-disk value), a common pattern for filesystem drivers that treat untrusted media metadata as authoritative. The fix adds exfat_test_bitmap_range() so the driver confirms that clusters backing the allocation bitmap are correctly flagged as allocated before use.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.12.58, 6.17.8, or 6.18 (or your distribution's equivalent - Ubuntu users apply USN-8095-1 at https://ubuntu.com/security/notices/USN-8095-1 and reboot into the new kernel). The upstream fixes are the git.kernel.org stable commits listed for CVE-2025-40307. Where immediate patching is not possible, reduce exposure by preventing untrusted exFAT media from being mounted: disable or restrict automatic mounting of removable devices (e.g., udisks2/USB auto-mount policies), and where exFAT is not required, blacklist the module by adding 'install exfat /bin/true' to modprobe configuration so crafted images cannot be parsed - the trade-off is that legitimate exFAT SD cards and USB drives will no longer mount. Also restrict which users hold mount privileges, since only local users able to mount attacker-supplied images can trigger the flaw.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40307 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy