CVE-2025-40067

Vulnerability

In the Linux kernel's NTFS3 filesystem, index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption. The kernel now rejects such cases by verifying that the bitmap is not empty when index blocks exist [1].

## Exploitation syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT due to unexpected index state [1].

Impact

An attacker with the ability to mount a crafted NTFS image can cause filesystem inconsistency, leading to failed rename operations and potential denial of service. No evidence of privilege escalation or remote code execution has been provided.

Mitigation

The fix is included in the stable kernel commit referenced [1]. Users are advised to update their kernels to include this patch. No workarounds are documented.