Look up another CVE · open CVE-2025-38615 in the interactive tracker
CVE-2025-38615
fs/ntfs3: cancle set bad inode after removing name fails
Published 2025-08-19 (14 months ago) by the Linux kernel CNA. Subsystem fs/ntfs3. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2025-38615 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.43-1 | Update the kernel and reboot. Fixed in 6.12.43-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.16.3-1 | Update the kernel and reboot. Fixed in 6.16.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.16.3-1 | Update the kernel and reboot. Fixed in 6.16.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted. The underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier". In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call make_bad_inode() on it just for shits and giggles".
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/ntfs3/frecord.c
fs/ntfs3/namei.c
fs/ntfs3/ntfs_fs.h
- What this is
- NTFS3 FILESYSTEMMAINTAINERS section matched on fs/ntfs3/ · ntfs3@lists.linux.dev · Supported
- Kernel module
- ntfs3
Check it on the machine
grep -w CONFIG_NTFS3_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ntfs3Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 3 releases. It does build it in 1 release, so the answer depends on which release the machine runs.
- bookwormn
- trixiem
- forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_NTFS3_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2025-08-19 (14 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/ntfs3
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.15 | 6.6.102 | b35a50d639ca |
| 5.15 | 6.12.42 | 3ed2cc6a6e93 |
| 5.15 | 6.15.10 | 358d4f821c03 |
| 5.15 | 6.16.1 | a28539502078 |
| 5.15 | 6.17 | d99208b91933 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerability is reached purely through local syscalls — `renameat2()` on a mounted ntfs3 volume followed by `openat()` on the affected path; there is no remote or network-facing consumer of this code.
- AC:LAttack complexity, low
- The attacker crafts the NTFS image so `ni_remove_name()` deterministically fails, and drives both sides of the `d_splice_alias()`/`make_bad_inode()` window with its own threads (a rename loop plus a lookup/open loop), so no condition lies outside its control; the downstream `S_ISDIR` bypass and inode-unhashing consequences need no race at all.
- PR:LPrivileges required, low
- Renaming and opening files on a mounted ntfs3 volume are ordinary unprivileged operations, and ntfs3 mounts default to permissive uid/gid/fmask/dmask permissions; the mount itself is obtained without any elevated credentials via udisks2 loop-setup/filesystem-mount, which are granted to active local sessions by default.
- UI:NUser interaction, none
- The attacker performs every step alone — supplying the crafted image, mounting it through udisks2 or removable-media auto-mount, then issuing the rename and open; no action by any other user is required.
- S:UScope, unchanged
- The wild-pointer dereference and inode/dcache state corruption occur entirely within the kernel's own security authority, crossing no VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- `pick_link()` dereferences `inode->i_link`, which actually holds `i_dir_seq` — a value the attacker inflates by adding directory entries — and consumes the target bytes as a symlink body steering path resolution, so on configurations without SMAP/PAN this yields an attacker-directed read primitive; the duplicate-inode aliasing additionally cross-links clusters between unrelated files.
- I:HIntegrity impact, high
- The corrupted symlink body redirects path resolution to attacker-chosen targets, the `S_IFDIR→S_IFREG` flip bypasses the non-empty-directory guard in `ntfs_unlink_inode()` allowing live directories to be unlinked, and duplicate `ntfs_inode`s for one MFT record double-free clusters — a memory- and metadata-corruption primitive steerable toward control-flow hijack.
- A:HAvailability impact, high
- syzbot reproduced a general protection fault / KASAN null-ptr-deref in `pick_link()` from `do_sys_openat2()`, and the unhashed live inode plus `ni->dir`/`ni->file` union confusion produce further oopses — any of which panics the kernel.