Memory Corruption Vulnerability in Linux Kernel Affects exFAT Filesystem

CVE-2025-40307

What is CVE-2025-40307?

A memory corruption vulnerability exists in the exFAT implementation of the Linux kernel. When creating an exFAT image with improperly set cluster bits in the allocation bitmap, it allows potential exploitation where existing entries may be deleted and reclaimed incorrectly. The vulnerabilities stem from the lack of validation for the cluster allocation bitmap when directories are created, which can lead to inconsistencies within the filesystem. The recent patch introduces validation checks to ensure that the clusters designated for allocation are indeed marked as in-use, thereby mitigating these risks.

References