Integer Overflow Vulnerability in Linux Kernel's NTFS3 Package
Summary
DEBIAN-CVE-2025-40068: In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in run_unpack() The MFT record relative to the file being opened contains its runlist, an array containing information a... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Linux operating system, responsible for managing hardware and system resources. The NTFS3 subsystem allows Linux to read and write to NTFS file systems, commonly used by Windows. This subsystem is crucial for interoperability between Linux and Windows environments. However, it is susceptible to vulnerabilities that can compromise data integrity and security.
Vulnerability Detail
In the Linux kernel, an integer overflow vulnerability has been identified in the run_unpack function of the NTFS3 subsystem. This issue arises when the runlist array, which contains information about a file's location on the disk, is not properly validated. An attacker can exploit this vulnerability by substituting the runlist in the $DATA attribute of an MFT record, potentially leading to unauthorized access to sensitive data or destruction of arbitrary data on the disk. The vulnerability was discovered by the Linux Verification Center and is tracked as CVE-2025-40068.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the NTFS3 subsystem for critical operations until the patch is applied. Additionally, users should ensure that their file systems are backed up regularly to prevent data loss.
Conclusion
The integer overflow vulnerability in the Linux kernel's NTFS3 subsystem poses serious risks to data integrity and security. Users are strongly encouraged to update their systems to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-40068 is an identifier for a specific vulnerability in the Linux kernel's NTFS3 subsystem, which can lead to integer overflow and potential data access issues.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data or destruction of data on the disk, posing significant risks to data integrity and security.
Yes, a patch has been released for the affected Linux kernel versions. Users are advised to update their systems to the latest version to mitigate the risk.
If immediate updates are not possible, consider using the NTFS3 subsystem cautiously and ensure regular backups of your data to minimize potential losses.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
