CVE-2025-40307

What it actually does

The flaw allows a malicious exFAT image to present an allocation bitmap whose clusters are not marked in-use; the kernel reads and trusts this bitmap without validation, permitting exfat_mkdir to zero a cluster that holds active directory entries and bitmap data, enabling reallocation of already-allocated clusters.

Why it matters to the business

Mounting untrusted removable media or images on affected kernels risks silent filesystem corruption and data loss on exFAT volumes; the issue affects any Linux deployment that handles external drives or user-supplied images, though low exploitability and absence from KEV reduce immediate enterprise urgency 322 days after publication.

How an attack unfolds

An attacker prepares an exFAT image whose allocation bitmap start cluster is marked free, mounts the image on a vulnerable kernel, triggers directory creation which zeros the bitmap cluster, and thereby reclaims already-allocated entries for reuse, resulting in metadata corruption.

How to fix it

Upgrade the Linux kernel to a version containing commit 6bc58b4c53795ab5fe00648344aa7d9d61175f90 or later; for stable trees apply the corresponding backport; avoid mounting untrusted exFAT images until patched.

How to confirm the fix worked

Confirm the running kernel contains the exfat_test_bitmap_range validation function and rejects images with unmarked bitmap clusters; test with crafted images that previously triggered the zeroing behavior.

Typical attack path

1. Craft exFAT image with invalid allocation bitmap cluster bits
2. Mount the image on a vulnerable kernel
3. Execute mkdir or equivalent directory creation
4. Observe bitmap and directory entry zeroing and reallocation

How to detect it

Review kernel logs for exfat allocation bitmap anomalies or unexpected cluster zeroing around the time of image mounts; correlate with user-space processes that create directories on newly mounted exFAT volumes.

What your security team should do

• Apply the referenced kernel commit or distribution update to all systems handling exFAT volumes
• Restrict exFAT mounting to trusted media only via mount options or policy
• Monitor kernel logs for exfat bitmap-related warnings after patching