---
id: CVE-2025-40067
title: 'fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

  Index allocation requires at least one bit in the $BITMAP attribute to
  track usage of index entr…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 47856e10f8d5e066aa26b1f9c02d933fe0620399 <
    aab2e34b139f6df71ab2b1adeec9927c206adc79
  - >-
    Linux >= b35a50d639ca5259466ef5fea85529bb4fb17d5b <
    978aac54e93ea35aab20b32ae393d3d33964e7ae
  - >-
    Linux >= 3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc <
    be66551da203862c689c12e1d35ce87217c017c1
  - >-
    Linux >= d99208b91933fd2a58ed9ed321af07dacd06ddc3 <
    039ddf353cc33f6546a87ec1ac3210637d714bec
  - >-
    Linux >= d99208b91933fd2a58ed9ed321af07dacd06ddc3 <
    0dc7117da8f92dd5fe077d712a756eccbe377d40
  - Linux 358d4f821c03add421a4c49290538a705852ccf1
  - Linux a285395020780adac1ffbc844069c3d700bf007a
  - Linux >= 6.6.102 < 6.6.112
  - Linux >= 6.12.42 < 6.12.53
  - Linux >= 6.15.10 < 6.16
  - Linux >= 6.16.1 < 6.17
  - Linux 6.17
published: '2025-10-28'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:22:46.051Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40067'
references:
  - url: 'https://git.kernel.org/stable/c/aab2e34b139f6df71ab2b1adeec9927c206adc79'
  - url: 'https://git.kernel.org/stable/c/978aac54e93ea35aab20b32ae393d3d33964e7ae'
  - url: 'https://git.kernel.org/stable/c/be66551da203862c689c12e1d35ce87217c017c1'
  - url: 'https://git.kernel.org/stable/c/039ddf353cc33f6546a87ec1ac3210637d714bec'
  - url: 'https://git.kernel.org/stable/c/0dc7117da8f92dd5fe077d712a756eccbe377d40'
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.05663
ingestedAt: '2026-11-03T22:57:11.348Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

Index allocation requires at least one bit in the $BITMAP attribute to
track usage of index entries. If the bitmap is empty while index blocks
are already present, this reflects on-disk corruption.

syzbot triggered this condition using a malformed NTFS image. During a
rename() operation involving a long filename (which spans multiple
index entries), the empty bitmap allowed the name to be added without
valid tracking. Subsequent deletion of the original entry failed with
-ENOENT, due to unexpected index state.

Reject such cases by verifying that the bitmap is not empty when index
blocks exist.

## Affected

- `Linux >= 47856e10f8d5e066aa26b1f9c02d933fe0620399 < aab2e34b139f6df71ab2b1adeec9927c206adc79`
- `Linux >= b35a50d639ca5259466ef5fea85529bb4fb17d5b < 978aac54e93ea35aab20b32ae393d3d33964e7ae`
- `Linux >= 3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc < be66551da203862c689c12e1d35ce87217c017c1`
- `Linux >= d99208b91933fd2a58ed9ed321af07dacd06ddc3 < 039ddf353cc33f6546a87ec1ac3210637d714bec`
- `Linux >= d99208b91933fd2a58ed9ed321af07dacd06ddc3 < 0dc7117da8f92dd5fe077d712a756eccbe377d40`
- `Linux 358d4f821c03add421a4c49290538a705852ccf1`
- `Linux a285395020780adac1ffbc844069c3d700bf007a`
- `Linux >= 6.6.102 < 6.6.112`
- `Linux >= 6.12.42 < 6.12.53`
- `Linux >= 6.15.10 < 6.16`
- `Linux >= 6.16.1 < 6.17`
- `Linux 6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.