CVE-2025-38692 exfat: add cluster chain loop check for dir
A corrupted exFAT filesystem can cause infinite loops in the Linux kernel, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38692?
CVE-2025-38692 is a medium-severity denial of service vulnerability in Linux kernel, published on 4 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
exfat: add cluster chain loop check for dir
An infinite loop may occur if the following conditions occur due to file system corruption.
(1) Condition for exfat_count_dir_entries() to loop infinitely. - The cluster chain includes a loop. - There is no UNUSED entry in the cluster chain.
(2) Condition for exfat_create_upcase_table() to loop infinitely. - The cluster chain of the root directory includes a loop. - There are no UNUSED entry and up-case table entry in the cluster chain of the root directory.
(3) Condition for exfat_load_bitmap() to loop infinitely. - The cluster chain of the root directory includes a loop. - There are no UNUSED entry and bitmap entry in the cluster chain of the root directory.
(4) Condition for exfat_find_dir_entry() to loop infinitely. - The cluster chain includes a loop. - The unused directory entries were exhausted by some operation.
(5) Condition for exfat_check_dir_empty() to loop infinitely. - The cluster chain includes a loop. - The unused directory entries were exhausted by some operation. - All files and sub-directories under the directory are deleted.
This commit adds checks to break the above infinite loop.
Weakness: CWE-835
Which versions are affected by CVE-2025-38692?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38692?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-38692 being exploited?
There is no known exploitation of CVE-2025-38692 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38692, DEBIAN-CVE-2025-38692, GHSA-77v7-59c5-2xxh, ROOT-OS-DEBIAN-11-CVE-2025-38692, ROOT-OS-DEBIAN-12-CVE-2025-38692, ROOT-OS-UBUNTU-2204-CVE-2025-38692 and 2 more.