Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2025-40287exfat: fix improper check of dentry.stream.valid_size

Description

In the Linux kernel, the following vulnerability has been resolved: exfat: fix improper check of dentry.stream.valid_size We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is malformed, the following system calls — SYS_openat, SYS_ftruncate, and SYS_pwrite64 — can cause the kernel to hang. Root cause analysis shows that the size validation code in exfat_find() does not check whether dentry.stream.valid_size is negative. As a result, the system calls mentioned above can succeed and eventually trigger the DoS issue. This patch adds a check for negative dentry.stream.valid_size to prevent this vulnerability.

Timeline

  1. ID reserved

    By Linux

  2. · 8 months later

    Published

  3. · 5 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Deferred.

EPSS (exploitation in 30 days)
0.20% · top 90% of all CVEs (13 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.

Affected products

  • Linux · Linux

    • affected 11a347fb6cef62ce47e84b97c45f2b2497c7593b – < 6c627bcc1896ba62ec793d0c00da74f3c93ce3ad
    • affected 11a347fb6cef62ce47e84b97c45f2b2497c7593b – < 204b1b02ee018ba52ad2ece21fe3a8643d66a1b2
    • affected 11a347fb6cef62ce47e84b97c45f2b2497c7593b – < 82ebecdc74ff555daf70b811d854b1f32a296bea

  • Linux · Linux

    • affected 6.8
    • unaffected < 6.8
    • unaffected 6.12.59 – ≤ 6.12.*
    • unaffected 6.17.9 – ≤ 6.17.*
    • unaffected 6.18 – ≤ *

References

References3

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-40287 badge
[![CVE-2025-40287](https://cveledger.app/badge/CVE-2025-40287.svg)](https://cveledger.app/cve/CVE-2025-40287)

Record last updated .