CVE-2025-40307 exfat: validate cluster allocation bits of the allocation bitmap
A missing validation in the Linux kernel exFAT filesystem allows attackers to corrupt allocation bitmaps, leading to data loss and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40307?
CVE-2025-40307 is a high-severity denial of service vulnerability in Linux, published on 8 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
exfat: validate cluster allocation bits of the allocation bitmap
syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use.
Which versions are affected by CVE-2025-40307?
How do I fix CVE-2025-40307?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-40307 being exploited?
There is no known exploitation of CVE-2025-40307 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40307, DEBIAN-CVE-2025-40307, GHSA-9mhh-qxx8-wc58, ROOT-OS-DEBIAN-11-CVE-2025-40307, ROOT-OS-DEBIAN-12-CVE-2025-40307, ROOT-OS-DEBIAN-13-CVE-2025-40307 and 3 more.