CVE-2025-40287
Description
In the Linux kernel, the following vulnerability has been resolved: exfat: fix improper check of dentry.stream.valid_size We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is malformed, the following system calls — SYS_openat, SYS_ftruncate, and SYS_pwrite64 — can cause the kernel to hang. Root cause analysis shows that the size validation code in exfat_find() does not check whether dentry.stream.valid_size is negative. As a result, the system calls mentioned above can succeed and eventually trigger the DoS issue. This patch adds a check for negative dentry.stream.valid_size to prevent this vulnerability.
How to fix
- Linux Linux6c627bcc1896ba62ec793d0c00da74f3c93ce3ad, 204b1b02ee018ba52ad2ece21fe3a8643d66a1b2, 82ebecdc74ff555daf70b811d854b1f32a296bea or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 11a347fb6cef62ce47e84b97c45f2b2497c7593b ≤ v < 6c627bcc1896ba62ec793d0c00da74f3c93ce3ad, 11a347fb6cef62ce47e84b97c45f2b2497c7593b ≤ v < 204b1b02ee018ba52ad2ece21fe3a8643d66a1b2, 11a347fb6cef62ce47e84b97c45f2b2497c7593b ≤ v < 82ebecdc74ff555daf70b811d854b1f32a296bea, 6.8 | 6c627bcc1896ba62ec793d0c00da74f3c93ce3ad, 204b1b02ee018ba52ad2ece21fe3a8643d66a1b2, 82ebecdc74ff555daf70b811d854b1f32a296bea |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.