The Linux kernel exFAT driver function exfat_find_dir_entry() improperly manages the advancement of the output pointer for filename entries. Specifically, each TYPE_EXTEND entry advances the output pointer by a fixed length (EXFAT_FILE_NAME_LEN), but the loop guard only tracks the total extracted name length, which can be smaller if name fragments contain early null bytes. This mismatch allows the output pointer to move beyond the allocated buffer (p_uniname->name[MAX_NAME_LENGTH + 3]), causing out-of-bounds read and write operations. The vulnerability was addressed by adding a per-entry write offset check to reject fragments that would exceed the maximum allowed name length before updating the output pointer.

This vulnerability can cause out-of-bounds memory access (read and write) in the kernel while processing exFAT directory entries. Such memory corruption could potentially lead to system instability or kernel crashes. The input must be a crafted exFAT directory with many short filename fragments to trigger the issue. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel by adding proper bounds checking on the output pointer advancement in exfat_find_dir_entry(). Users should update their Linux kernel to a version that includes this fix once available. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or vendor updates for the specific fixed versions and apply the update accordingly.