CVE-2025-40068

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40068", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.159Z", "datePublished": "2025-10-28T11:48:37.636Z", "dateUpdated": "2026-08-05T12:07:31.436Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:31.436Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: Fix integer overflow in run_unpack()\n\nThe MFT record relative to the file being opened contains its runlist,\nan array containing information about the file's location on the physical\ndisk. Analysis of all Call Stack paths showed that the values of the\nrunlist array, from which LCNs are calculated, are not validated before\nrun_unpack function.\n\nThe run_unpack function decodes the compressed runlist data format\nfrom MFT attributes (for example, $DATA), converting them into a runs_tree\nstructure, which describes the mapping of virtual clusters (VCN) to\nlogical clusters (LCN). The NTFS3 subsystem also has a shortcut for\ndeleting files from MFT records - in this case, the RUN_DEALLOCATE\ncommand is sent to the run_unpack input, and the function logic\nprovides that all data transferred to the runlist about file or\ndirectory is deleted without creating a runs_tree structure.\n\nSubstituting the runlist in the $DATA attribute of the MFT record for an\narbitrary file can lead either to access to arbitrary data on the disk\nbypassing access checks to them (since the inode access check\noccurs above) or to destruction of arbitrary data on the disk.\n\nAdd overflow check for addition operation.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The malformed runlist is consumed from an NTFS volume image, which reaches the kernel only through a local mount of a block device, loop file, or removable medium (kiosk/desktop automount via udisks2 is the realistic delivery vector). There is no network-facing path into `run_unpack()`.\nAC:L - The attacker writes the packed `dlcn`/`len` fields of the runlist directly, so the `prev_lcn + dlcn` and `vcn64 + len` wraps are chosen deterministically; no race, memory-layout grooming, or timing is involved. The bug triggers on the first parse of the crafted attribute.\nPR:N - The attacker needs no account or privilege on the target \u2014 they only supply the crafted image (USB stick, downloaded disk image, attached volume), and the parsing happens entirely inside the mount performed by the victim or the automounter. This matches the scoring of the sibling `run_unpack()` overflow, CVE-2026-46062.\nUI:N - Someone or something on the target must mount the crafted NTFS volume before `ntfs_read_mft()`/`attr_load_runs()` reach `run_unpack()`, which is a distinct victim action (inserting/mounting the medium).\nS:U - The corrupted `runs_tree`, out-of-volume cluster I/O and bitmap damage are all confined to the kernel and the filesystem it manages; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The wrapped LCN bypasses the `lcn + len > sbi->used.bitmap.nbits` volume-bounds check, so reads of the attacker's file are serviced from arbitrary clusters belonging to other files \u2014 the commit states this yields \"access to arbitrary data on the disk bypassing access checks,\" because the inode permission check occurs above this layer.\nI:H - The same unvalidated LCNs let writes to the attacker's file land on arbitrary clusters, and the `RUN_DEALLOCATE` path drives `mark_as_free_ex()`/`wnd_set_free()`/`ntfs_unmap_and_discard()` over out-of-range ranges, corrupting the cluster bitmap and discarding live blocks \u2014 the commit calls this \"destruction of arbitrary data on the disk.\"\nA:H - A `runs_tree` built from wrapped VCN/LCN values produces out-of-range block I/O, out-of-bounds cluster-bitmap manipulation, and inconsistent allocation metadata, readily producing oops/BUG and rendering the mounted volume \u2014 and on a root or system NTFS volume the machine \u2014 unusable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/run.c"], "versions": [{"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "f6b36cfd25cbadad63447c673743cf771090e756", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "3ac37e100385b59ac821a62118494442238aaac4", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "a86c8b9d03f7101e1750233846fe989df6f0d631", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "9378cfe228c2c679564a4116bcb28c8e89dff989", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "5aa5799d162ad1b8e8b699d48b6218143c695a78", "status": "affected", "versionType": "git"}, {"version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "lessThan": "736fc7bf5f68f6b74a0925b7e072c571838657d2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/run.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.195", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.156", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.112", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.53", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.195"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.156"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f6b36cfd25cbadad63447c673743cf771090e756"}, {"url": "https://git.kernel.org/stable/c/3ac37e100385b59ac821a62118494442238aaac4"}, {"url": "https://git.kernel.org/stable/c/a86c8b9d03f7101e1750233846fe989df6f0d631"}, {"url": "https://git.kernel.org/stable/c/9378cfe228c2c679564a4116bcb28c8e89dff989"}, {"url": "https://git.kernel.org/stable/c/5aa5799d162ad1b8e8b699d48b6218143c695a78"}, {"url": "https://git.kernel.org/stable/c/736fc7bf5f68f6b74a0925b7e072c571838657d2"}], "title": "fs: ntfs3: Fix integer overflow in run_unpack()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs3/run.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f6b36cfd25cbadad63447c673743cf771090e756", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "3ac37e100385b59ac821a62118494442238aaac4", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "a86c8b9d03f7101e1750233846fe989df6f0d631", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "9378cfe228c2c679564a4116bcb28c8e89dff989", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "5aa5799d162ad1b8e8b699d48b6218143c695a78", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}, {"lessThan": "736fc7bf5f68f6b74a0925b7e072c571838657d2", "status": "affected", "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs3/run.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.195", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.156", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.112", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.53", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: Fix integer overflow in run_unpack()\n\nThe MFT record relative to the file being opened contains its runlist,\nan array containing information about the file's location on the physical\ndisk. Analysis of all Call Stack paths showed that the values of the\nrunlist array, from which LCNs are calculated, are not validated before\nrun_unpack function.\n\nThe run_unpack function decodes the compressed runlist data format\nfrom MFT attributes (for example, $DATA), converting them into a runs_tree\nstructure, which describes the mapping of virtual clusters (VCN) to\nlogical clusters (LCN). The NTFS3 subsystem also has a shortcut for\ndeleting files from MFT records - in this case, the RUN_DEALLOCATE\ncommand is sent to the run_unpack input, and the function logic\nprovides that all data transferred to the runlist about file or\ndirectory is deleted without creating a runs_tree structure.\n\nSubstituting the runlist in the $DATA attribute of the MFT record for an\narbitrary file can lead either to access to arbitrary data on the disk\nbypassing access checks to them (since the inode access check\noccurs above) or to destruction of arbitrary data on the disk.\n\nAdd overflow check for addition operation.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfs: ntfs3: Correcci\u00f3n de desbordamiento de entero en run_unpack()\n\nEl registro MFT relativo al archivo que se est\u00e1 abriendo contiene su runlist, una matriz que contiene informaci\u00f3n sobre la ubicaci\u00f3n del archivo en el disco f\u00edsico. El an\u00e1lisis de todas las rutas de la pila de llamadas (Call Stack) mostr\u00f3 que los valores de la matriz runlist, a partir de los cuales se calculan los LCN, no se validan antes de la funci\u00f3n run_unpack.\n\nLa funci\u00f3n run_unpack decodifica el formato de datos runlist comprimido de los atributos MFT (por ejemplo, $DATA), convirti\u00e9ndolos en una estructura runs_tree, que describe el mapeo de cl\u00fasteres virtuales (VCN) a cl\u00fasteres l\u00f3gicos (LCN). El subsistema NTFS3 tambi\u00e9n tiene un atajo para eliminar archivos de los registros MFT; en este caso, el comando RUN_DEALLOCATE se env\u00eda a la entrada de run_unpack, y la l\u00f3gica de la funci\u00f3n establece que todos los datos transferidos al runlist sobre el archivo o directorio se eliminan sin crear una estructura runs_tree.\n\nSustituir el runlist en el atributo $DATA del registro MFT para un archivo arbitrario puede llevar a acceder a datos arbitrarios en el disco, eludiendo las comprobaciones de acceso a los mismos (ya que la comprobaci\u00f3n de acceso del inodo ocurre antes) o a la destrucci\u00f3n de datos arbitrarios en el disco.\n\nA\u00f1adir comprobaci\u00f3n de desbordamiento para la operaci\u00f3n de adici\u00f3n.\n\nEncontrado por Linux Verification Center (linuxtesting.org) con SVACE."}], "id": "CVE-2025-40068", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-10-28T12:15:41.277", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3ac37e100385b59ac821a62118494442238aaac4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5aa5799d162ad1b8e8b699d48b6218143c695a78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/736fc7bf5f68f6b74a0925b7e072c571838657d2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9378cfe228c2c679564a4116bcb28c8e89dff989"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a86c8b9d03f7101e1750233846fe989df6f0d631"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f6b36cfd25cbadad63447c673743cf771090e756"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: fs: ntfs3: Fix integer overflow in run_unpack()", "id": "2406740", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406740"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40068", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40068\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40068\nhttps://lore.kernel.org/linux-cve-announce/2025102818-CVE-2025-40068-1b0e@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-29T10:58:15.138829+00:00", "updated": "2025-10-29T10:58:15.138852+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}