LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40307: exfat: validate cluster allocation bits of the allocation bitmap

In the Linux kernel, the following vulnerability has been resolved: exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Linux can mishandle a deliberately malformed exFAT filesystem whose allocation bitmap does not reserve its own storage. Creating a directory may then erase filesystem metadata, potentially causing data corruption, data loss, or broader compromise of the affected system. The attacker needs local access and a vulnerable system that processes the malformed filesystem.

Executive priority

Prioritize systems that ingest removable media, disk images, or other untrusted exFAT content. Accelerate kernel remediation where those workflows coexist with local user access or sensitive data. Internet-facing systems without an exFAT ingestion path are less likely to be directly exposed.

Technical view

The exFAT driver trusted allocation-bitmap cluster markings without validating that the bitmap’s own clusters were allocated. A malformed image could make a bitmap cluster appear free; exfat_mkdir could allocate and zero it, deleting entries and enabling repeated reallocation. The referenced kernel changes add allocation-range validation.

Likely exposure

Exposure is most likely on vulnerable Linux systems that mount attacker-controlled or otherwise untrusted exFAT media or images and allow local filesystem operations. The supplied affected-version data is irregular, so administrators should confirm exposure using their distribution’s advisory and kernel build provenance.

Exploitation context

The CVSS vector describes a local, low-complexity attack requiring low privileges, without user interaction. Syzbot demonstrated the faulty behavior using a malformed exFAT image. The supplied record says this CVE is not in KEV, and no cited evidence establishes active exploitation in the wild.

Researcher notes

The impact arises from inconsistent exFAT allocation metadata and destructive reuse of the bitmap’s own cluster. The public description supports corruption and reallocation consequences but does not establish a complete exploitation chain. Branch-specific remediation should be determined from the referenced stable commits and downstream vendor advisories.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable referenced exFAT validation fix.
  • Check distribution advisories because downstream kernel versions may not map directly to upstream version numbers.
  • Restrict mounting of untrusted exFAT media and filesystem images until remediation is confirmed.
  • Apply least privilege to users and services permitted to mount or modify exFAT filesystems.

Validation and detection

  • Inventory Linux hosts that enable or use the kernel exFAT driver.
  • Record kernel package versions and compare them with distribution security advisories.
  • Verify the installed kernel contains the applicable referenced fix or documented backport.
  • Review systems for workflows that mount removable, uploaded, or otherwise untrusted exFAT content.
  • Use safe regression testing to confirm malformed filesystems are rejected without metadata corruption.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40307 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-40307Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003, 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003, 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003, 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003, 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003unaffected
LinuxLinux5.7, 0, 6.1.183, 6.6.148, 6.12.58, 6.17.8, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.