CVE-2025-40313 ntfs3: pretend $Extend records as regular files
A flaw in the Linux kernel ntfs3 driver mishandles $Extend records, potentially causing system instability or crashes when accessing specific NTFS structures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40313?
CVE-2025-40313 is a vulnerability in Linux, published on 8 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: pretend $Extend records as regular files
Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records.
Which versions are affected by CVE-2025-40313?
How do I fix CVE-2025-40313?
Apply the vendor's patch.
Is CVE-2025-40313 being exploited?
There is no known exploitation of CVE-2025-40313 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40313, DEBIAN-CVE-2025-40313, GHSA-2c7r-cgw2-h422, ROOT-OS-DEBIAN-12-CVE-2025-40313, ROOT-OS-DEBIAN-13-CVE-2025-40313, ROOT-OS-UBUNTU-2204-CVE-2025-40313 and 2 more.