CVE-2025-40068 (GCVE-0-2025-40068)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07
VLAI
Title
fs: ntfs3: Fix integer overflow in run_unpack()
Summary
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in run_unpack() The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths showed that the values of the runlist array, from which LCNs are calculated, are not validated before run_unpack function. The run_unpack function decodes the compressed runlist data format from MFT attributes (for example, $DATA), converting them into a runs_tree structure, which describes the mapping of virtual clusters (VCN) to logical clusters (LCN). The NTFS3 subsystem also has a shortcut for deleting files from MFT records - in this case, the RUN_DEALLOCATE command is sent to the run_unpack input, and the function logic provides that all data transferred to the runlist about file or directory is deleted without creating a runs_tree structure. Substituting the runlist in the $DATA attribute of the MFT record for an arbitrary file can lead either to access to arbitrary data on the disk bypassing access checks to them (since the inode access check occurs above) or to destruction of arbitrary data on the disk. Add overflow check for addition operation. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < f6b36cfd25cbadad63447c673743cf771090e756 (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 3ac37e100385b59ac821a62118494442238aaac4 (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < a86c8b9d03f7101e1750233846fe989df6f0d631 (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 9378cfe228c2c679564a4116bcb28c8e89dff989 (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 5aa5799d162ad1b8e8b699d48b6218143c695a78 (git)
Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 736fc7bf5f68f6b74a0925b7e072c571838657d2 (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.156 , ≤ 6.1.* (semver)
Unaffected: 6.6.112 , ≤ 6.6.* (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/run.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6b36cfd25cbadad63447c673743cf771090e756",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "3ac37e100385b59ac821a62118494442238aaac4",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "a86c8b9d03f7101e1750233846fe989df6f0d631",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "9378cfe228c2c679564a4116bcb28c8e89dff989",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "5aa5799d162ad1b8e8b699d48b6218143c695a78",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "736fc7bf5f68f6b74a0925b7e072c571838657d2",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/run.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: Fix integer overflow in run_unpack()\n\nThe MFT record relative to the file being opened contains its runlist,\nan array containing information about the file\u0027s location on the physical\ndisk. Analysis of all Call Stack paths showed that the values of the\nrunlist array, from which LCNs are calculated, are not validated before\nrun_unpack function.\n\nThe run_unpack function decodes the compressed runlist data format\nfrom MFT attributes (for example, $DATA), converting them into a runs_tree\nstructure, which describes the mapping of virtual clusters (VCN) to\nlogical clusters (LCN). The NTFS3 subsystem also has a shortcut for\ndeleting files from MFT records - in this case, the RUN_DEALLOCATE\ncommand is sent to the run_unpack input, and the function logic\nprovides that all data transferred to the runlist about file or\ndirectory is deleted without creating a runs_tree structure.\n\nSubstituting the runlist in the $DATA attribute of the MFT record for an\narbitrary file can lead either to access to arbitrary data on the disk\nbypassing access checks to them (since the inode access check\noccurs above) or to destruction of arbitrary data on the disk.\n\nAdd overflow check for addition operation.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed runlist is consumed from an NTFS volume image, which reaches the kernel only through a local mount of a block device, loop file, or removable medium (kiosk/desktop automount via udisks2 is the realistic delivery vector). There is no network-facing path into `run_unpack()`.\nAC:L - The attacker writes the packed `dlcn`/`len` fields of the runlist directly, so the `prev_lcn + dlcn` and `vcn64 + len` wraps are chosen deterministically; no race, memory-layout grooming, or timing is involved. The bug triggers on the first parse of the crafted attribute.\nPR:N - The attacker needs no account or privilege on the target \u2014 they only supply the crafted image (USB stick, downloaded disk image, attached volume), and the parsing happens entirely inside the mount performed by the victim or the automounter. This matches the scoring of the sibling `run_unpack()` overflow, CVE-2026-46062.\nUI:N - Someone or something on the target must mount the crafted NTFS volume before `ntfs_read_mft()`/`attr_load_runs()` reach `run_unpack()`, which is a distinct victim action (inserting/mounting the medium).\nS:U - The corrupted `runs_tree`, out-of-volume cluster I/O and bitmap damage are all confined to the kernel and the filesystem it manages; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The wrapped LCN bypasses the `lcn + len \u003e sbi-\u003eused.bitmap.nbits` volume-bounds check, so reads of the attacker\u0027s file are serviced from arbitrary clusters belonging to other files \u2014 the commit states this yields \"access to arbitrary data on the disk bypassing access checks,\" because the inode permission check occurs above this layer.\nI:H - The same unvalidated LCNs let writes to the attacker\u0027s file land on arbitrary clusters, and the `RUN_DEALLOCATE` path drives `mark_as_free_ex()`/`wnd_set_free()`/`ntfs_unmap_and_discard()` over out-of-range ranges, corrupting the cluster bitmap and discarding live blocks \u2014 the commit calls this \"destruction of arbitrary data on the disk.\"\nA:H - A `runs_tree` built from wrapped VCN/LCN values produces out-of-range block I/O, out-of-bounds cluster-bitmap manipulation, and inconsistent allocation metadata, readily producing oops/BUG and rendering the mounted volume \u2014 and on a root or system NTFS volume the machine \u2014 unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:31.436Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6b36cfd25cbadad63447c673743cf771090e756"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ac37e100385b59ac821a62118494442238aaac4"
        },
        {
          "url": "https://git.kernel.org/stable/c/a86c8b9d03f7101e1750233846fe989df6f0d631"
        },
        {
          "url": "https://git.kernel.org/stable/c/9378cfe228c2c679564a4116bcb28c8e89dff989"
        },
        {
          "url": "https://git.kernel.org/stable/c/5aa5799d162ad1b8e8b699d48b6218143c695a78"
        },
        {
          "url": "https://git.kernel.org/stable/c/736fc7bf5f68f6b74a0925b7e072c571838657d2"
        }
      ],
      "title": "fs: ntfs3: Fix integer overflow in run_unpack()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40068",
    "datePublished": "2025-10-28T11:48:37.636Z",
    "dateReserved": "2025-04-16T07:20:57.159Z",
    "dateUpdated": "2026-08-05T12:07:31.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40068",
      "date": "2026-08-11",
      "epss": "0.0017",
      "percentile": "0.06609"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40068\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-28T12:15:41.277\",\"lastModified\":\"2026-07-30T06:24:09.537\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs: ntfs3: Fix integer overflow in run_unpack()\\n\\nThe MFT record relative to the file being opened contains its runlist,\\nan array containing information about the file\u0027s location on the physical\\ndisk. Analysis of all Call Stack paths showed that the values of the\\nrunlist array, from which LCNs are calculated, are not validated before\\nrun_unpack function.\\n\\nThe run_unpack function decodes the compressed runlist data format\\nfrom MFT attributes (for example, $DATA), converting them into a runs_tree\\nstructure, which describes the mapping of virtual clusters (VCN) to\\nlogical clusters (LCN). The NTFS3 subsystem also has a shortcut for\\ndeleting files from MFT records - in this case, the RUN_DEALLOCATE\\ncommand is sent to the run_unpack input, and the function logic\\nprovides that all data transferred to the runlist about file or\\ndirectory is deleted without creating a runs_tree structure.\\n\\nSubstituting the runlist in the $DATA attribute of the MFT record for an\\narbitrary file can lead either to access to arbitrary data on the disk\\nbypassing access checks to them (since the inode access check\\noccurs above) or to destruction of arbitrary data on the disk.\\n\\nAdd overflow check for addition operation.\\n\\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs3/run.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"f6b36cfd25cbadad63447c673743cf771090e756\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"3ac37e100385b59ac821a62118494442238aaac4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"a86c8b9d03f7101e1750233846fe989df6f0d631\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"9378cfe228c2c679564a4116bcb28c8e89dff989\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"5aa5799d162ad1b8e8b699d48b6218143c695a78\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4342306f0f0d5ff4315a204d315c1b51b914fca5\",\"lessThan\":\"736fc7bf5f68f6b74a0925b7e072c571838657d2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs3/run.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.195\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.156\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.112\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.53\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.3\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3ac37e100385b59ac821a62118494442238aaac4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5aa5799d162ad1b8e8b699d48b6218143c695a78\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/736fc7bf5f68f6b74a0925b7e072c571838657d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9378cfe228c2c679564a4116bcb28c8e89dff989\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a86c8b9d03f7101e1750233846fe989df6f0d631\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f6b36cfd25cbadad63447c673743cf771090e756\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:15:42+00:00",
      "cve": "CVE-2025-40068",
      "id": "CVE-2025-40068",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs: ntfs3: Fix integer overflow in run_unpack()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40068.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T16:50:26Z",
      "cve": "CVE-2025-40068",
      "id": "CVE-2025-40068",
      "initial_release_date": "2025-10-29T00:24:53Z",
      "product_status:known_not_affected": "407",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40068",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40068.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.