The Linux kernel NTFS3 driver had a vulnerability where index allocation proceeded despite the $BITMAP attribute being empty while index blocks were present. This inconsistency reflects on-disk corruption and was triggered by malformed NTFS images during rename operations involving long filenames spanning multiple index entries. The empty bitmap allowed adding names without proper tracking, causing subsequent deletion failures with -ENOENT errors due to unexpected index states. The fix enforces verification that the bitmap is not empty when index blocks exist, preventing this inconsistent state.

This vulnerability can cause filesystem inconsistencies leading to failures in file operations such as renaming and deleting files with long filenames on NTFS partitions. The CVSS vector indicates local attack vector with low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor for official kernel updates addressing CVE-2025-40067 and apply them promptly once available.