CVE-2025-40307

Vulnerability

CVE-2025-40307 is a vulnerability in the Linux kernel's exfat filesystem. The issue arises because the filesystem does not validate that the clusters used for the allocation bitmap are correctly marked as in-use in the bitmap itself. This means that when the allocation bitmap start cluster (e.g., cluster 6) is not marked as allocated, it can be treated as free and later allocated for other purposes, such as creating a new directory.

Exploitation

An attacker can craft a malicious exfat image that omits the allocation bitmap's own cluster from its bitmap, marking it as free. When this image is mounted, the exfat driver will read and use the bitmap without checking this inconsistency. If a user subsequently creates a directory (via mkdir), the kernel may allocate that same cluster for the directory and zero it out. This overwrites both the original allocation bitmap data and any other existing entries stored in that cluster.

Impact

By zeroing out the allocation bitmap, the attacker can cause subsequent allocations to reuse clusters that previously held data, leading to data corruption. Additionally, the original bitmap data is lost, potentially allowing further exploitation. The vulnerability can lead to file system corruption and possible data loss.

Mitigation

The fix was applied in a Linux kernel commit that adds the function exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use [1]. Users should apply the kernel update containing this commit to mitigate the vulnerability.