LiveActive security incident?Get immediate response
CVE Record

CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Prevent integer overflow in hdr_first_de() The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.

HighCVSS 8.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux’s NTFS3 filesystem can make a safety check fail when 32-bit systems process specially formed on-disk values. This could threaten confidentiality, integrity, and availability at kernel level. The issue is local rather than remotely network-exploitable, but systems handling untrusted NTFS media or images deserve prompt attention.

Executive priority

Prioritize affected 32-bit systems that accept removable media, disk images, or other untrusted NTFS content. Expedite normal kernel patching and temporarily restrict such inputs where updates cannot be applied promptly. Lower priority is reasonable only after confirming the architecture, kernel build, or workload is unaffected.

Technical view

Disk-controlled NTFS3 values de_off and used can trigger a 32-bit integer overflow near UINT_MAX, undermining validation in hdr_first_de(). The supplied CVSS 3.1 score is 8.4 with local access, low complexity, no privileges, and no user interaction. The bundle lists affected Linux releases including 6.2, 6.6.87, 6.12.23, 6.13.11, 6.14.2, and 6.15.

Likely exposure

Exposure is most likely on affected 32-bit Linux systems using NTFS3 to process untrusted or attacker-influenced NTFS disk data. The bundle does not establish exposure for every distribution package, and its version data includes an ambiguous entry of "0." Confirm applicability through the relevant Linux distribution or kernel vendor.

Exploitation context

The supplied record marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Its CVSS vector describes local attack conditions, not direct remote network exploitation. Malicious on-disk NTFS metadata is the relevant input, but the bundle does not document a demonstrated attack chain.

Researcher notes

CWE-190 applies: both de_off and used originate on disk, and arithmetic near UINT_MAX can wrap on 32-bit systems. The referenced stable commits are the supplied remediation evidence. The bundle does not describe the resulting memory operation, proof of concept, exploit reliability, affected distribution packages, or precise version-range semantics.

Mitigation direction

  • Apply a vendor-approved kernel update containing the applicable referenced stable fix.
  • Restrict processing of untrusted NTFS volumes or images on potentially affected 32-bit systems until updated.
  • Consult distribution security guidance for fixed package versions and backport status.
  • Reboot into the updated kernel where required by the distribution.

Validation and detection

  • Identify 32-bit Linux hosts and record their running kernel versions.
  • Determine whether those hosts use NTFS3 or process externally supplied NTFS data.
  • Compare installed packages with distribution advisories and confirmed fixed builds.
  • After remediation, verify the running kernel contains the applicable upstream or backported fix.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-190: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-22080 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.4CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9Linux
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

8.4High
CVSS 3.1 vector shape for CVE-2025-22080Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux60ce8dfde03558bfc290cd915c60fa243ba2ae84, 60ce8dfde03558bfc290cd915c60fa243ba2ae84, 60ce8dfde03558bfc290cd915c60fa243ba2ae84, 60ce8dfde03558bfc290cd915c60fa243ba2ae84, 60ce8dfde03558bfc290cd915c60fa243ba2ae84unaffected
LinuxLinux6.2, 0, 6.6.87, 6.12.23, 6.13.11, 6.14.2, 6.15affected
Weakness

CWE details

CWE-190

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-190 · source CWE mapping

Integer Overflow or Wraparound

Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs