In the Linux kernel, the following vulnerability has been resolved: exfat: validate cluster allocation bits of the allocation bitmap syzbot created… (CVE-2025-40307)
In the Linux kernel, the following vulnerability has been resolved: exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use.
AI Analysis
Technical Summary
The Linux kernel exFAT filesystem driver did not validate cluster allocation bits of the allocation bitmap correctly. Specifically, when the start cluster of the allocation bitmap is 6, cluster 6 could be allocated during a mkdir operation, causing exfat_mkdir to zero out this cluster and potentially delete existing directory entries. Additionally, the allocation bitmap itself could be zeroed out, allowing reallocation of clusters that should remain allocated. The patch adds a validation function, exfat_test_bitmap_range, to ensure clusters used for the allocation bitmap are marked as in-use, preventing this improper reallocation.
Potential Impact
This vulnerability can lead to high impact outcomes including corruption of the filesystem's allocation bitmap and deletion of existing directory entries. This results in confidentiality, integrity, and availability impacts (C:H/I:H/A:H) as data may be lost or corrupted due to improper cluster reallocation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel security advisories for the availability of an official fix and apply it promptly once available.
In the Linux kernel, the following vulnerability has been resolved: exfat: validate cluster allocation bits of the allocation bitmap syzbot created… (CVE-2025-40307)
Description
In the Linux kernel, the following vulnerability has been resolved: exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel exFAT filesystem driver did not validate cluster allocation bits of the allocation bitmap correctly. Specifically, when the start cluster of the allocation bitmap is 6, cluster 6 could be allocated during a mkdir operation, causing exfat_mkdir to zero out this cluster and potentially delete existing directory entries. Additionally, the allocation bitmap itself could be zeroed out, allowing reallocation of clusters that should remain allocated. The patch adds a validation function, exfat_test_bitmap_range, to ensure clusters used for the allocation bitmap are marked as in-use, preventing this improper reallocation.
Potential Impact
This vulnerability can lead to high impact outcomes including corruption of the filesystem's allocation bitmap and deletion of existing directory entries. This results in confidentiality, integrity, and availability impacts (C:H/I:H/A:H) as data may be lost or corrupted due to improper cluster reallocation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel security advisories for the availability of an official fix and apply it promptly once available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9mhh-qxx8-wc58
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40307"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d49c2644c7f847922a
Added to database: 07/30/2026, 15:50:44 UTC
Last enriched: 07/30/2026, 17:52:58 UTC
Last updated: 09/10/2026, 19:26:51 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.