CVE-2025-38692
Description
In the Linux kernel, the following vulnerability has been resolved: exfat: add cluster chain loop check for dir An infinite loop may occur if the following conditions occur due to file system corruption. (1) Condition for exfat_count_dir_entries() to loop infinitely. - The cluster chain includes a loop. - There is no UNUSED entry in the cluster chain. (2) Condition for exfat_create_upcase_table() to loop infinitely. - The cluster chain of the root directory includes a loop. - There are no UNUSED entry and up-case table entry in the cluster chain of the root directory. (3) Condition for exfat_load_bitmap() to loop infinitely. - The cluster chain of the root directory includes a loop. - There are no UNUSED entry and bitmap entry in the cluster chain of the root directory. (4) Condition for exfat_find_dir_entry() to loop infinitely. - The cluster chain includes a loop. - The unused directory entries were exhausted by some operation. (5) Condition for exfat_check_dir_empty() to loop infinitely. - The cluster chain includes a loop. - The unused directory entries were exhausted by some operation. - All files and sub-directories under the directory are deleted. This commit adds checks to break the above infinite loop.
How to fix
- linux linux_kernel6.6.103, 6.12.43, 6.15.11, 6.16.2 or later
- git.kernel.org/stable/c/4c3cda20c4cf1871e27868d08fda06b79bc7d568
- git.kernel.org/stable/c/868f23286c1a13162330fa6c614fe350f78e3f82
- git.kernel.org/stable/c/99f9a97dce39ad413c39b92c90393bbd6778f3fd
- git.kernel.org/stable/c/aa8fe7b7b73d4c9a41bb96cb3fb3092f794ecb33
- git.kernel.org/stable/c/e2066ca3ef49a30920d8536fa366b2a183a808ee
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 5.7 ≤ v < 6.6.103, 6.7 ≤ v < 6.12.43, 6.13 ≤ v < 6.15.11, 6.16 ≤ v < 6.16.2 | 6.6.103, 6.12.43, 6.15.11, 6.16.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.