{"api_version":"1","generated_at":"2026-08-04T12:19:00+00:00","cve":"CVE-2025-40068","urls":{"html":"https://cve.report/CVE-2025-40068","api":"https://cve.report/api/cve/CVE-2025-40068.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-40068","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-40068"},"summary":{"title":"fs: ntfs3: Fix integer overflow in run_unpack()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: Fix integer overflow in run_unpack()\n\nThe MFT record relative to the file being opened contains its runlist,\nan array containing information about the file's location on the physical\ndisk. Analysis of all Call Stack paths showed that the values of the\nrunlist array, from which LCNs are calculated, are not validated before\nrun_unpack function.\n\nThe run_unpack function decodes the compressed runlist data format\nfrom MFT attributes (for example, $DATA), converting them into a runs_tree\nstructure, which describes the mapping of virtual clusters (VCN) to\nlogical clusters (LCN). The NTFS3 subsystem also has a shortcut for\ndeleting files from MFT records - in this case, the RUN_DEALLOCATE\ncommand is sent to the run_unpack input, and the function logic\nprovides that all data transferred to the runlist about file or\ndirectory is deleted without creating a runs_tree structure.\n\nSubstituting the runlist in the $DATA attribute of the MFT record for an\narbitrary file can lead either to access to arbitrary data on the disk\nbypassing access checks to them (since the inode access check\noccurs above) or to destruction of arbitrary data on the disk.\n\nAdd overflow check for addition operation.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-10-28 12:15:41","updated_at":"2026-07-30 06:24:09"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.4","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.4","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/f6b36cfd25cbadad63447c673743cf771090e756","name":"https://git.kernel.org/stable/c/f6b36cfd25cbadad63447c673743cf771090e756","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3ac37e100385b59ac821a62118494442238aaac4","name":"https://git.kernel.org/stable/c/3ac37e100385b59ac821a62118494442238aaac4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5aa5799d162ad1b8e8b699d48b6218143c695a78","name":"https://git.kernel.org/stable/c/5aa5799d162ad1b8e8b699d48b6218143c695a78","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a86c8b9d03f7101e1750233846fe989df6f0d631","name":"https://git.kernel.org/stable/c/a86c8b9d03f7101e1750233846fe989df6f0d631","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/736fc7bf5f68f6b74a0925b7e072c571838657d2","name":"https://git.kernel.org/stable/c/736fc7bf5f68f6b74a0925b7e072c571838657d2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9378cfe228c2c679564a4116bcb28c8e89dff989","name":"https://git.kernel.org/stable/c/9378cfe228c2c679564a4116bcb28c8e89dff989","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40068","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40068","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4342306f0f0d5ff4315a204d315c1b51b914fca5 f6b36cfd25cbadad63447c673743cf771090e756 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4342306f0f0d5ff4315a204d315c1b51b914fca5 3ac37e100385b59ac821a62118494442238aaac4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4342306f0f0d5ff4315a204d315c1b51b914fca5 a86c8b9d03f7101e1750233846fe989df6f0d631 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4342306f0f0d5ff4315a204d315c1b51b914fca5 9378cfe228c2c679564a4116bcb28c8e89dff989 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4342306f0f0d5ff4315a204d315c1b51b914fca5 5aa5799d162ad1b8e8b699d48b6218143c695a78 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4342306f0f0d5ff4315a204d315c1b51b914fca5 736fc7bf5f68f6b74a0925b7e072c571838657d2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.195 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.156 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.112 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.53 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17.3 6.17.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"40068","cve":"CVE-2025-40068","epss":"0.001700000","percentile":"0.066320000","score_date":"2026-07-31","updated_at":"2026-08-01 00:10:35"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ntfs3/run.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f6b36cfd25cbadad63447c673743cf771090e756","status":"affected","version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","versionType":"git"},{"lessThan":"3ac37e100385b59ac821a62118494442238aaac4","status":"affected","version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","versionType":"git"},{"lessThan":"a86c8b9d03f7101e1750233846fe989df6f0d631","status":"affected","version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","versionType":"git"},{"lessThan":"9378cfe228c2c679564a4116bcb28c8e89dff989","status":"affected","version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","versionType":"git"},{"lessThan":"5aa5799d162ad1b8e8b699d48b6218143c695a78","status":"affected","version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","versionType":"git"},{"lessThan":"736fc7bf5f68f6b74a0925b7e072c571838657d2","status":"affected","version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ntfs3/run.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.195","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.156","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.112","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.53","versionType":"semver"},{"lessThanOrEqual":"6.17.*","status":"unaffected","version":"6.17.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.18","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.195","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.156","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.112","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.53","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17.3","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18","versionStartIncluding":"5.15","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: Fix integer overflow in run_unpack()\n\nThe MFT record relative to the file being opened contains its runlist,\nan array containing information about the file's location on the physical\ndisk. Analysis of all Call Stack paths showed that the values of the\nrunlist array, from which LCNs are calculated, are not validated before\nrun_unpack function.\n\nThe run_unpack function decodes the compressed runlist data format\nfrom MFT attributes (for example, $DATA), converting them into a runs_tree\nstructure, which describes the mapping of virtual clusters (VCN) to\nlogical clusters (LCN). The NTFS3 subsystem also has a shortcut for\ndeleting files from MFT records - in this case, the RUN_DEALLOCATE\ncommand is sent to the run_unpack input, and the function logic\nprovides that all data transferred to the runlist about file or\ndirectory is deleted without creating a runs_tree structure.\n\nSubstituting the runlist in the $DATA attribute of the MFT record for an\narbitrary file can lead either to access to arbitrary data on the disk\nbypassing access checks to them (since the inode access check\noccurs above) or to destruction of arbitrary data on the disk.\n\nAdd overflow check for addition operation.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}],"metrics":[{"cvssV3_1":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-07-30T06:00:22.806Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f6b36cfd25cbadad63447c673743cf771090e756"},{"url":"https://git.kernel.org/stable/c/3ac37e100385b59ac821a62118494442238aaac4"},{"url":"https://git.kernel.org/stable/c/a86c8b9d03f7101e1750233846fe989df6f0d631"},{"url":"https://git.kernel.org/stable/c/9378cfe228c2c679564a4116bcb28c8e89dff989"},{"url":"https://git.kernel.org/stable/c/5aa5799d162ad1b8e8b699d48b6218143c695a78"},{"url":"https://git.kernel.org/stable/c/736fc7bf5f68f6b74a0925b7e072c571838657d2"}],"title":"fs: ntfs3: Fix integer overflow in run_unpack()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-40068","datePublished":"2025-10-28T11:48:37.636Z","dateReserved":"2025-04-16T07:20:57.159Z","dateUpdated":"2026-07-30T06:00:22.806Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-10-28 12:15:41","lastModifiedDate":"2026-07-30 06:24:09","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"40068","Ordinal":"1","Title":"fs: ntfs3: Fix integer overflow in run_unpack()","CVE":"CVE-2025-40068","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"40068","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: Fix integer overflow in run_unpack()\n\nThe MFT record relative to the file being opened contains its runlist,\nan array containing information about the file's location on the physical\ndisk. Analysis of all Call Stack paths showed that the values of the\nrunlist array, from which LCNs are calculated, are not validated before\nrun_unpack function.\n\nThe run_unpack function decodes the compressed runlist data format\nfrom MFT attributes (for example, $DATA), converting them into a runs_tree\nstructure, which describes the mapping of virtual clusters (VCN) to\nlogical clusters (LCN). The NTFS3 subsystem also has a shortcut for\ndeleting files from MFT records - in this case, the RUN_DEALLOCATE\ncommand is sent to the run_unpack input, and the function logic\nprovides that all data transferred to the runlist about file or\ndirectory is deleted without creating a runs_tree structure.\n\nSubstituting the runlist in the $DATA attribute of the MFT record for an\narbitrary file can lead either to access to arbitrary data on the disk\nbypassing access checks to them (since the inode access check\noccurs above) or to destruction of arbitrary data on the disk.\n\nAdd overflow check for addition operation.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.","Type":"Description","Title":"fs: ntfs3: Fix integer overflow in run_unpack()"}]}}}