{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2025-40067",
  "modified": "2026-10-07T14:35:31Z",
  "upstream": [
    "CVE-2025-40067"
  ],
  "published": "2025-10-28T11:50:45Z",
  "summary": "fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist\n\nIndex allocation requires at least one bit in the $BITMAP attribute to\ntrack usage of index entries. If the bitmap is empty while index blocks\nare already present, this reflects on-disk corruption.\n\nsyzbot triggered this condition using a malformed NTFS image. During a\nrename() operation involving a long filename (which spans multiple\nindex entries), the empty bitmap allowed the name to be added without\nvalid tracking. Subsequent deletion of the original entry failed with\n-ENOENT, due to unexpected index state.\n\nReject such cases by verifying that the bitmap is not empty when index\nblocks exist.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.12.47-1+rpt1~bookworm"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-2712",
            "binary_version": "1:6.12.47-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v6",
            "binary_version": "1:6.12.47-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v7",
            "binary_version": "1:6.12.47-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v7l",
            "binary_version": "1:6.12.47-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v8",
            "binary_version": "1:6.12.47-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.47-1+rpt1~bookworm"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.12.47-1+rpt1~bookworm": {
            "linux_commit": "359f37f0faefb712add32a39f98751aea67d5c1f",
            "upstream_version": "6.12.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.53"
          }
        }
      }
    },
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:13",
        "name": "linux"
      },
      "versions": [
        "1:6.12.47-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-2712",
            "binary_version": "1:6.12.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v6",
            "binary_version": "1:6.12.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v7",
            "binary_version": "1:6.12.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v8",
            "binary_version": "1:6.12.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.47-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.12.47-1+rpt1": {
            "linux_commit": "359f37f0faefb712add32a39f98751aea67d5c1f",
            "upstream_version": "6.12.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.53"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40067"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/978aac54e93ea35aab20b32ae393d3d33964e7ae"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/be66551da203862c689c12e1d35ce87217c017c1"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/039ddf353cc33f6546a87ec1ac3210637d714bec"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0dc7117da8f92dd5fe077d712a756eccbe377d40"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T12:19:11Z"
  }
}