Integer Overflow in Linux Kernel ntfs3 Affects Data Deletion and Access

CVE-2025-40068

What is CVE-2025-40068?

The Linux Kernel's ntfs3 subsystem has a vulnerability that arises from an unchecked integer overflow in the 'run_unpack' function, which processes the runlist of an NTFS disk. This oversight allows an attacker to manipulate the runlist data, potentially gaining unauthorized access to sensitive data or causing unintended data destruction on the physical disk. The vulnerability stems from the lack of validation on values in the runlist array, which are crucial for mapping virtual to logical clusters. By exploiting this flaw, it is possible to circumvent access checks and delete crucial files without proper verification.

References