CVE-2025-38615

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38615
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: cancle set bad inode after removing name fails The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted. The underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier". In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call make_bad_inode() on it just for shits and giggles".

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/358d4f821c03add421a4c49290538a705852ccf1 Patch
https://git.kernel.org/stable/c/3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc Patch
https://git.kernel.org/stable/c/a285395020780adac1ffbc844069c3d700bf007a Patch
https://git.kernel.org/stable/c/b35a50d639ca5259466ef5fea85529bb4fb17d5b Patch
https://git.kernel.org/stable/c/d99208b91933fd2a58ed9ed321af07dacd06ddc3 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

26 Nov 2025, 17:41

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/358d4f821c03add421a4c49290538a705852ccf1 - () https://git.kernel.org/stable/c/358d4f821c03add421a4c49290538a705852ccf1 - Patch
References () https://git.kernel.org/stable/c/3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc - () https://git.kernel.org/stable/c/3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc - Patch
References () https://git.kernel.org/stable/c/a285395020780adac1ffbc844069c3d700bf007a - () https://git.kernel.org/stable/c/a285395020780adac1ffbc844069c3d700bf007a - Patch
References () https://git.kernel.org/stable/c/b35a50d639ca5259466ef5fea85529bb4fb17d5b - () https://git.kernel.org/stable/c/b35a50d639ca5259466ef5fea85529bb4fb17d5b - Patch
References () https://git.kernel.org/stable/c/d99208b91933fd2a58ed9ed321af07dacd06ddc3 - () https://git.kernel.org/stable/c/d99208b91933fd2a58ed9ed321af07dacd06ddc3 - Patch
First Time Linux
Linux linux Kernel
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

20 Aug 2025, 14:40

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/ntfs3: falla la cancelación de un inodo erróneo tras eliminar el nombre. El reproductor usa un archivo "file0" en un sistema de archivos ntfs3 con un i_link dañado. Al renombrar, el inodo de archivo "file0" se marca como erróneo porque no se puede eliminar el nombre del archivo. El error subyacente radica en que se llama a make_bad_inode() en un inodo activo. En algunos casos, la búsqueda de icache encuentra un inodo normal, se llama a d_splice_alias() para asociarlo a dentry, mientras que otro hilo decide llamar a make_bad_inode() en él; eso lo expulsaría de icache, pero ya lo habíamos encontrado allí anteriormente. En otros casos, es simplemente: "Tenemos un inodo asociado a dentry; así es como lo obtuvimos; llamemos a make_bad_inode() en él, solo por diversión".

19 Aug 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-19 17:15

Updated : 2025-11-26 17:41

NVD link : CVE-2025-38615

Mitre link : CVE-2025-38615

CVE.ORG link : CVE-2025-38615

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo