CVE-2025-40307

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40307", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.185Z", "datePublished": "2025-12-08T00:46:32.659Z", "dateUpdated": "2026-10-15T22:02:43.363Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:27:52.404Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: validate cluster allocation bits of the allocation bitmap\n\nsyzbot created an exfat image with cluster bits not set for the allocation\nbitmap. exfat-fs reads and uses the allocation bitmap without checking\nthis. The problem is that if the start cluster of the allocation bitmap\nis 6, cluster 6 can be allocated when creating a directory with mkdir.\nexfat zeros out this cluster in exfat_mkdir, which can delete existing\nentries. This can reallocate the allocated entries. In addition,\nthe allocation bitmap is also zeroed out, so cluster 6 can be reallocated.\nThis patch adds exfat_test_bitmap_range to validate that clusters used for\nthe allocation bitmap are correctly marked as in-use."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached by getting a crafted exFAT image mounted from a local block device, loop file, or removable medium and then issuing a local `mkdir()`; there is no network consumer of `exfat_allocate_bitmap()`.\nAC:L - The attacker fully controls the image: clearing the bitmap's own allocation bit and pointing `start_clu` at a low cluster makes `exfat_find_free_bitmap()` deterministically return that cluster on the very first allocation, so a single `mkdir` reliably zeroes the live bitmap with no race, heap shaping, or memory-layout dependency.\nPR:L - Direct `mount()` needs CAP_SYS_ADMIN, but ubiquitous privileged mount brokers (udisks2, systemd-mount, autofs, Android vold) let an unprivileged local user get an attacker-supplied exFAT volume or loop image mounted rw, after which any user with write access to the mount can run the triggering `mkdir`.\nUI:N - The attacker requests the mount through the automount broker and runs `mkdir` themselves; on a kiosk or shared workstation inserting their own exFAT stick achieves the same, with no action required from any other user or administrator.\nS:U - The corruption and its consequences are confined to the kernel and filesystem that own the mount; no VM, IOMMU, container, or other security-authority boundary is crossed.\nC:H - Once the bitmap is zeroed the allocator re-hands out clusters that are still live, so a newly created file is backed by clusters holding the root directory, other files' data, and the allocation bitmap itself \u2014 reading that file discloses their full contents, an unbounded read of co-resident data on the shared volume rather than a small bounded leak.\nI:H - This is the core defect: the kernel zeroes and overwrites in-use on-disk metadata (\"can delete existing entries\") and reallocates already-allocated clusters, so attacker-controlled file writes land directly in directory entries and in the live in-kernel allocation bitmap, giving unbounded modification of structures the filesystem subsequently trusts.\nA:H - The zeroed bitmap makes every `exfat_clear_bitmap()` fail with `-EIO`, desyncs `used_clusters` into `exfat_fs_error_ratelimit()`, and produces aliased/looping cluster chains that yield task hangs and the syzbot-reported deadlock WARNING; with `errors=panic`, `panic_on_warn`, or `panic_on_oops` this is a full panic, and the volume is left permanently unusable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/exfat/balloc.c"], "versions": [{"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "lessThan": "87f827d53bd0688597bda63ae95908e2ad39bac0", "status": "affected", "versionType": "git"}, {"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "lessThan": "67ce8034dc0278ddd88cad93d4218a945180dddd", "status": "affected", "versionType": "git"}, {"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "lessThan": "6bc58b4c53795ab5fe00648344aa7d9d61175f90", "status": "affected", "versionType": "git"}, {"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "lessThan": "13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf", "status": "affected", "versionType": "git"}, {"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "lessThan": "79c1587b6cda74deb0c86fc7ba194b92958c793c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/exfat/balloc.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.58", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.58"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/87f827d53bd0688597bda63ae95908e2ad39bac0"}, {"url": "https://git.kernel.org/stable/c/67ce8034dc0278ddd88cad93d4218a945180dddd"}, {"url": "https://git.kernel.org/stable/c/6bc58b4c53795ab5fe00648344aa7d9d61175f90"}, {"url": "https://git.kernel.org/stable/c/13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf"}, {"url": "https://git.kernel.org/stable/c/79c1587b6cda74deb0c86fc7ba194b92958c793c"}], "title": "exfat: validate cluster allocation bits of the allocation bitmap", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40307", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:59:01.153133Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:43.363Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40307", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:59:01.153133Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:59:03.763Z"}}], "cna": {"title": "exfat: validate cluster allocation bits of the allocation bitmap", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached by getting a crafted exFAT image mounted from a local block device, loop file, or removable medium and then issuing a local `mkdir()`; there is no network consumer of `exfat_allocate_bitmap()`.\nAC:L - The attacker fully controls the image: clearing the bitmap's own allocation bit and pointing `start_clu` at a low cluster makes `exfat_find_free_bitmap()` deterministically return that cluster on the very first allocation, so a single `mkdir` reliably zeroes the live bitmap with no race, heap shaping, or memory-layout dependency.\nPR:L - Direct `mount()` needs CAP_SYS_ADMIN, but ubiquitous privileged mount brokers (udisks2, systemd-mount, autofs, Android vold) let an unprivileged local user get an attacker-supplied exFAT volume or loop image mounted rw, after which any user with write access to the mount can run the triggering `mkdir`.\nUI:N - The attacker requests the mount through the automount broker and runs `mkdir` themselves; on a kiosk or shared workstation inserting their own exFAT stick achieves the same, with no action required from any other user or administrator.\nS:U - The corruption and its consequences are confined to the kernel and filesystem that own the mount; no VM, IOMMU, container, or other security-authority boundary is crossed.\nC:H - Once the bitmap is zeroed the allocator re-hands out clusters that are still live, so a newly created file is backed by clusters holding the root directory, other files' data, and the allocation bitmap itself \u2014 reading that file discloses their full contents, an unbounded read of co-resident data on the shared volume rather than a small bounded leak.\nI:H - This is the core defect: the kernel zeroes and overwrites in-use on-disk metadata (\"can delete existing entries\") and reallocates already-allocated clusters, so attacker-controlled file writes land directly in directory entries and in the live in-kernel allocation bitmap, giving unbounded modification of structures the filesystem subsequently trusts.\nA:H - The zeroed bitmap makes every `exfat_clear_bitmap()` fail with `-EIO`, desyncs `used_clusters` into `exfat_fs_error_ratelimit()`, and produces aliased/looping cluster chains that yield task hangs and the syzbot-reported deadlock WARNING; with `errors=panic`, `panic_on_warn`, or `panic_on_oops` this is a full panic, and the volume is left permanently unusable."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "lessThan": "87f827d53bd0688597bda63ae95908e2ad39bac0", "versionType": "git"}, {"status": "affected", "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "lessThan": "67ce8034dc0278ddd88cad93d4218a945180dddd", "versionType": "git"}, {"status": "affected", "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "lessThan": "6bc58b4c53795ab5fe00648344aa7d9d61175f90", "versionType": "git"}, {"status": "affected", "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "lessThan": "13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf", "versionType": "git"}, {"status": "affected", "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "lessThan": "79c1587b6cda74deb0c86fc7ba194b92958c793c", "versionType": "git"}], "programFiles": ["fs/exfat/balloc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"status": "unaffected", "version": "0", "lessThan": "5.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.58", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.8", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/exfat/balloc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/87f827d53bd0688597bda63ae95908e2ad39bac0"}, {"url": "https://git.kernel.org/stable/c/67ce8034dc0278ddd88cad93d4218a945180dddd"}, {"url": "https://git.kernel.org/stable/c/6bc58b4c53795ab5fe00648344aa7d9d61175f90"}, {"url": "https://git.kernel.org/stable/c/13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf"}, {"url": "https://git.kernel.org/stable/c/79c1587b6cda74deb0c86fc7ba194b92958c793c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: validate cluster allocation bits of the allocation bitmap\n\nsyzbot created an exfat image with cluster bits not set for the allocation\nbitmap. exfat-fs reads and uses the allocation bitmap without checking\nthis. The problem is that if the start cluster of the allocation bitmap\nis 6, cluster 6 can be allocated when creating a directory with mkdir.\nexfat zeros out this cluster in exfat_mkdir, which can delete existing\nentries. This can reallocate the allocated entries. In addition,\nthe allocation bitmap is also zeroed out, so cluster 6 can be reallocated.\nThis patch adds exfat_test_bitmap_range to validate that clusters used for\nthe allocation bitmap are correctly marked as in-use."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.148", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.58", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.8", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "5.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:27:52.404Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40307", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:43.363Z", "dateReserved": "2025-04-16T07:20:57.185Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-08T00:46:32.659Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/exfat/balloc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "87f827d53bd0688597bda63ae95908e2ad39bac0", "status": "affected", "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "versionType": "git"}, {"lessThan": "67ce8034dc0278ddd88cad93d4218a945180dddd", "status": "affected", "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "versionType": "git"}, {"lessThan": "6bc58b4c53795ab5fe00648344aa7d9d61175f90", "status": "affected", "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "versionType": "git"}, {"lessThan": "13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf", "status": "affected", "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "versionType": "git"}, {"lessThan": "79c1587b6cda74deb0c86fc7ba194b92958c793c", "status": "affected", "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/exfat/balloc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.58", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: validate cluster allocation bits of the allocation bitmap\n\nsyzbot created an exfat image with cluster bits not set for the allocation\nbitmap. exfat-fs reads and uses the allocation bitmap without checking\nthis. The problem is that if the start cluster of the allocation bitmap\nis 6, cluster 6 can be allocated when creating a directory with mkdir.\nexfat zeros out this cluster in exfat_mkdir, which can delete existing\nentries. This can reallocate the allocated entries. In addition,\nthe allocation bitmap is also zeroed out, so cluster 6 can be reallocated.\nThis patch adds exfat_test_bitmap_range to validate that clusters used for\nthe allocation bitmap are correctly marked as in-use."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nexfat: validar los bits de asignaci\u00f3n de cl\u00faster del mapa de bits de asignaci\u00f3n\n\nsyzbot cre\u00f3 una imagen exfat con bits de cl\u00faster no establecidos para el mapa de bits de asignaci\u00f3n. exfat-fs lee y utiliza el mapa de bits de asignaci\u00f3n sin comprobar esto. El problema es que si el cl\u00faster de inicio del mapa de bits de asignaci\u00f3n es 6, el cl\u00faster 6 puede ser asignado al crear un directorio con mkdir. exfat pone a cero este cl\u00faster en exfat_mkdir, lo que puede eliminar entradas existentes. Esto puede reasignar las entradas asignadas. Adem\u00e1s, el mapa de bits de asignaci\u00f3n tambi\u00e9n se pone a cero, por lo que el cl\u00faster 6 puede ser reasignado. Este parche a\u00f1ade exfat_test_bitmap_range para validar que los cl\u00fasteres utilizados para el mapa de bits de asignaci\u00f3n est\u00e1n correctamente marcados como en uso."}], "id": "CVE-2025-40307", "lastModified": "2026-10-15T22:19:07.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40307", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:59:01.153133Z", "version": "2.0.3"}}]}, "published": "2025-12-08T01:16:02.950", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/67ce8034dc0278ddd88cad93d4218a945180dddd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6bc58b4c53795ab5fe00648344aa7d9d61175f90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79c1587b6cda74deb0c86fc7ba194b92958c793c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87f827d53bd0688597bda63ae95908e2ad39bac0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: exfat: validate cluster allocation bits of the allocation bitmap", "id": "2419844", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419844"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nexfat: validate cluster allocation bits of the allocation bitmap\nsyzbot created an exfat image with cluster bits not set for the allocation\nbitmap. exfat-fs reads and uses the allocation bitmap without checking\nthis. The problem is that if the start cluster of the allocation bitmap\nis 6, cluster 6 can be allocated when creating a directory with mkdir.\nexfat zeros out this cluster in exfat_mkdir, which can delete existing\nentries. This can reallocate the allocated entries. In addition,\nthe allocation bitmap is also zeroed out, so cluster 6 can be reallocated.\nThis patch adds exfat_test_bitmap_range to validate that clusters used for\nthe allocation bitmap are correctly marked as in-use."], "name": "CVE-2025-40307", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40307\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40307\nhttps://lore.kernel.org/linux-cve-announce/2025120820-CVE-2025-40307-40f1@gregkh/T"], "threat_severity": "Moderate"}

{}