CVE-2025-40067High· 7.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entr…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption.
syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT, due to unexpected index state.
Reject such cases by verifying that the bitmap is not empty when index blocks exist.
Linux >= 47856e10f8d5e066aa26b1f9c02d933fe0620399 < aab2e34b139f6df71ab2b1adeec9927c206adc79Linux >= b35a50d639ca5259466ef5fea85529bb4fb17d5b < 978aac54e93ea35aab20b32ae393d3d33964e7aeLinux >= 3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc < be66551da203862c689c12e1d35ce87217c017c1Linux >= d99208b91933fd2a58ed9ed321af07dacd06ddc3 < 039ddf353cc33f6546a87ec1ac3210637d714becLinux >= d99208b91933fd2a58ed9ed321af07dacd06ddc3 < 0dc7117da8f92dd5fe077d712a756eccbe377d40Linux 358d4f821c03add421a4c49290538a705852ccf1Linux a285395020780adac1ffbc844069c3d700bf007aLinux >= 6.6.102 < 6.6.112Linux >= 6.12.42 < 6.12.53Linux >= 6.15.10 < 6.16Linux >= 6.16.1 < 6.17Linux 6.17Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses