CVE-2025-38692

What it actually does

The flaw permits infinite loops in multiple exFAT functions (exfat_count_dir_entries, exfat_create_upcase_table, exfat_load_bitmap, exfat_find_dir_entry, exfat_check_dir_empty) when a corrupted filesystem presents a cluster chain loop without required unused or special entries.

Why it matters to the business

Systems relying on exFAT volumes risk hangs, high CPU usage, or unresponsiveness during mount or directory operations on corrupted media; low EPSS and absence from KEV indicate limited real-world exploitation risk despite 418 days of public exposure.

How an attack unfolds

An attacker supplies a deliberately corrupted exFAT image containing a cluster chain loop; when the kernel performs directory enumeration, bitmap loading, or upcase table creation on the volume, one of the affected functions enters an infinite loop, resulting in denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 868f23286c1a13162330fa6c614fe350f78e3f82, which adds explicit cluster chain loop detection and termination in the exFAT driver.

How to confirm the fix worked

Confirm the fix is present by inspecting kernel source for the loop-check logic or by verifying the running kernel is built from a tree that includes commit 868f23286c1a13162330fa6c614fe350f78e3f82; test with previously looping images.

Typical attack path

1. Craft or obtain an exFAT filesystem image with a looped cluster chain lacking unused entries
2. Cause the target system to mount the image or enumerate its root directory
3. Trigger one of the five vulnerable exFAT functions to enter an infinite loop

How to detect it

Look in kernel logs and process traces for threads stuck inside exFAT directory or bitmap functions; monitor for sudden high CPU or unresponsive mounts involving exFAT volumes.

What your security team should do

• Apply the referenced kernel commit or later stable releases on any system that mounts exFAT volumes
• Treat exFAT volumes from untrusted sources as potentially malicious until patched
• Disable the exFAT driver at build or runtime if the filesystem is not required