Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in run_unpack() The MFT record relative to the… (CVE-2025-40068)
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in run_unpack() The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths showed that the values of the runlist array, from which LCNs are calculated, are not validated before run_unpack function. The run_unpack function decodes the compressed runlist data format from MFT attributes (for example, $DATA), converting them into a runs_tree structure, which describes the mapping of virtual clusters (VCN) to logical clusters (LCN). The NTFS3 subsystem also has a shortcut for deleting files from MFT records - in this case, the RUN_DEALLOCATE command is sent to the run_unpack input, and the function logic provides that all data transferred to the runlist about file or directory is deleted without creating a runs_tree structure. Substituting the runlist in the $DATA attribute of the MFT record for an arbitrary file can lead either to access to arbitrary data on the disk bypassing access checks to them (since the inode access check occurs above) or to destruction of arbitrary data on the disk. Add overflow check for addition operation. Found by Linux Verification Center (linuxtesting.org) with SVACE.
AI Analysis
Technical Summary
The Linux kernel NTFS3 driver contained an integer overflow vulnerability in the run_unpack() function, which decodes compressed runlist data from MFT attributes. The runlist array values were not validated before processing, allowing crafted runlist data to bypass inode access checks or cause arbitrary data destruction on disk. The flaw was due to missing overflow checks on addition operations within run_unpack. The vulnerability was discovered by the Linux Verification Center and has been fixed by adding an overflow check.
Potential Impact
Exploitation of this vulnerability could allow an attacker with local access to a system to bypass access controls on files or cause arbitrary data corruption or destruction on disk. The vulnerability affects confidentiality, integrity, and availability of data managed by the NTFS3 filesystem driver.
Mitigation Recommendations
A fix has been implemented in the Linux kernel NTFS3 driver by adding an integer overflow check in the run_unpack() function. Users and administrators should apply the official Linux kernel updates that include this fix to mitigate the vulnerability. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the specific patched kernel versions.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in run_unpack() The MFT record relative to the… (CVE-2025-40068)
Description
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in run_unpack() The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths showed that the values of the runlist array, from which LCNs are calculated, are not validated before run_unpack function. The run_unpack function decodes the compressed runlist data format from MFT attributes (for example, $DATA), converting them into a runs_tree structure, which describes the mapping of virtual clusters (VCN) to logical clusters (LCN). The NTFS3 subsystem also has a shortcut for deleting files from MFT records - in this case, the RUN_DEALLOCATE command is sent to the run_unpack input, and the function logic provides that all data transferred to the runlist about file or directory is deleted without creating a runs_tree structure. Substituting the runlist in the $DATA attribute of the MFT record for an arbitrary file can lead either to access to arbitrary data on the disk bypassing access checks to them (since the inode access check occurs above) or to destruction of arbitrary data on the disk. Add overflow check for addition operation. Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS v3.1
Score 8.4high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel NTFS3 driver contained an integer overflow vulnerability in the run_unpack() function, which decodes compressed runlist data from MFT attributes. The runlist array values were not validated before processing, allowing crafted runlist data to bypass inode access checks or cause arbitrary data destruction on disk. The flaw was due to missing overflow checks on addition operations within run_unpack. The vulnerability was discovered by the Linux Verification Center and has been fixed by adding an overflow check.
Potential Impact
Exploitation of this vulnerability could allow an attacker with local access to a system to bypass access controls on files or cause arbitrary data corruption or destruction on disk. The vulnerability affects confidentiality, integrity, and availability of data managed by the NTFS3 filesystem driver.
Mitigation Recommendations
A fix has been implemented in the Linux kernel NTFS3 driver by adding an integer overflow check in the run_unpack() function. Users and administrators should apply the official Linux kernel updates that include this fix to mitigate the vulnerability. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the specific patched kernel versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gv9m-p4c7-mxp3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40068"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d69c2644c7f847af1c
Added to database: 07/30/2026, 15:50:46 UTC
Last enriched: 07/30/2026, 16:23:12 UTC
Last updated: 09/10/2026, 19:24:56 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.