CVE-2025-40313 json
ntfs3: pretend $Extend records as regular files
published 2025-12-08 11 mo ago modified 2026-10-14 25 d ago also EUVD-2025-201632
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: pretend $Extend records as regular files
Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records.
Patch / fix
- Linux Linux 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, 6.18
- linux Debian 12 6.1.159-1
- linux Debian 13 6.12.63-1
- linux Debian 14 6.17.8-1
debian advisories DEBIAN-CVE-2025-40313
- linux Ubuntu 22.04 LTS 5.15.0-173.183
- linux Ubuntu 24.04 LTS 6.8.0-106.106
- linux Ubuntu 25.10 6.17.0-14.14
- linux-aws Ubuntu 22.04 LTS 5.15.0-1103.110
- linux-aws Ubuntu 24.04 LTS 6.8.0-1050.53
- linux-aws Ubuntu 25.10 6.17.0-1007.7
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1103.112
- linux-gcp Ubuntu 24.04 LTS 6.8.0-1052.55
ubuntu advisories UBUNTU-CVE-2025-40313
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- git.kernel.org/stable/c/63eb6730ce0604d3eacf036c2f68ea70b068317c commit
- git.kernel.org/stable/c/78d46f5276ed3589aaaa435580068c5b62efc921 commit
- git.kernel.org/stable/c/17249b2a65274f73ed68bcd1604e08a60fd8a278 commit
- git.kernel.org/stable/c/37f65e68ba9852dc51c78dbb54a9881c3f0fe4f7 commit
- git.kernel.org/stable/c/57534db1bbc4ca772393bb7d92e69d5e7b9051cf commit
- git.kernel.org/stable/c/4e8011ffec79717e5fdac43a7e79faf811a384b7 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-40313 updated
kernel: ntfs3: pretend $Extend records as regular files
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernelnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
Affected products
- Linux Linux
Classification
- Technology feeds
References
- git.kernel.org /stable/c/63eb6730ce0604d3eacf036c2f68ea70b068317c
- git.kernel.org /stable/c/78d46f5276ed3589aaaa435580068c5b62efc921
- git.kernel.org /stable/c/17249b2a65274f73ed68bcd1604e08a60fd8a278
- git.kernel.org /stable/c/37f65e68ba9852dc51c78dbb54a9881c3f0fe4f7
- git.kernel.org /stable/c/57534db1bbc4ca772393bb7d92e69d5e7b9051cf
- git.kernel.org /stable/c/4e8011ffec79717e5fdac43a7e79faf811a384b7
Sources
- CVE List CVE-2025-40313
- NVD CVE-2025-40313
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.