CVE-2025-40068

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fs: ntfs3: Fix integer overflow in run_unpack()

The MFT record relative to the file being opened contains its runlist,

an array containing information about the file's location on the physical

disk. Analysis of all Call Stack paths showed that the values of the

runlist array, from which LCNs are calculated, are not validated before

run_unpack function.

The run_unpack function decodes the compressed runlist data format

from MFT attributes (for example, $DATA), converting them into a runs_tree

structure, which describes the mapping of virtual clusters (VCN) to

logical clusters (LCN). The NTFS3 subsystem also has a shortcut for

deleting files from MFT records - in this case, the RUN_DEALLOCATE

command is sent to the run_unpack input, and the function logic

provides that all data transferred to the runlist about file or

directory is deleted without creating a runs_tree structure.

Substituting the runlist in the $DATA a

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References