CVE-2025-38692
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
04/09/2025
Last modified:
24/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
exfat: add cluster chain loop check for dir<br />
<br />
An infinite loop may occur if the following conditions occur due to<br />
file system corruption.<br />
<br />
(1) Condition for exfat_count_dir_entries() to loop infinitely.<br />
- The cluster chain includes a loop.<br />
- There is no UNUSED entry in the cluster chain.<br />
<br />
(2) Condition for exfat_create_upcase_table() to loop infinitely.<br />
- The cluster chain of the root directory includes a loop.<br />
- There are no UNUSED entry and up-case table entry in the cluster<br />
chain of the root directory.<br />
<br />
(3) Condition for exfat_load_bitmap() to loop infinitely.<br />
- The cluster chain of the root directory includes a loop.<br />
- There are no UNUSED entry and bitmap entry in the cluster chain<br />
of the root directory.<br />
<br />
(4) Condition for exfat_find_dir_entry() to loop infinitely.<br />
- The cluster chain includes a loop.<br />
- The unused directory entries were exhausted by some operation.<br />
<br />
(5) Condition for exfat_check_dir_empty() to loop infinitely.<br />
- The cluster chain includes a loop.<br />
- The unused directory entries were exhausted by some operation.<br />
- All files and sub-directories under the directory are deleted.<br />
<br />
This commit adds checks to break the above infinite loop.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.7 (including) | 6.6.103 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.43 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.15.11 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.16 (including) | 6.16.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/4c3cda20c4cf1871e27868d08fda06b79bc7d568
- https://git.kernel.org/stable/c/868f23286c1a13162330fa6c614fe350f78e3f82
- https://git.kernel.org/stable/c/99f9a97dce39ad413c39b92c90393bbd6778f3fd
- https://git.kernel.org/stable/c/aa8fe7b7b73d4c9a41bb96cb3fb3092f794ecb33
- https://git.kernel.org/stable/c/e2066ca3ef49a30920d8536fa366b2a183a808ee



