CVE-2025-40287: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40287 is a Denial-of-Service vulnerability in the Linux kernel's exFAT filesystem driver caused by improper validation of dentry.stream.valid_size. When a dentry in an exFAT filesystem is malformed, system calls SYS_openat, SYS_ftruncate, and SYS_pwrite64 can trigger an infinite loop, causing the kernel to hang. The vulnerability was published on December 6, 2025, and affects Linux kernel versions from the initial commit (1da177e4c3f4) up to the patched releases. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector with high availability impact (Red Hat CVE, Microsoft MSRC).

The root cause is an improper input validation flaw (CWE-20) in the exfat_find() function within the Linux kernel's exFAT filesystem implementation. The size validation code fails to check whether dentry.stream.valid_size is a negative value; because the field is treated as an unsigned or unchecked quantity, a malformed filesystem entry with a negative valid_size passes validation and allows subsequent system calls to proceed into an infinite loop. An attacker must have local access and the ability to mount or interact with a crafted exFAT filesystem image to trigger the condition. No public proof-of-concept exploit code has been identified (Red Hat CVE, ENISA EUVD).

Successful exploitation causes the kernel to enter an infinite loop, rendering the affected system completely unresponsive — a full Denial-of-Service condition. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems mounting untrusted or attacker-controlled exFAT volumes (e.g., removable media, shared storage) are at greatest risk, and a single low-privileged local user can trigger the hang without any user interaction (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation requires local access with at least low privileges, limiting the attack surface compared to remotely exploitable vulnerabilities (ENISA EUVD).

1. Prepare a malformed exFAT image: Craft an exFAT filesystem image containing a directory entry (dentry) where dentry.stream.valid_size is set to a negative value (e.g., using a hex editor or custom filesystem-building tool).
2. Mount the image: As a low-privileged local user with mount permissions (or via auto-mount of removable media), mount the crafted exFAT image on the target Linux system.
3. Trigger the vulnerable code path: Execute one or more of the following system calls against a file within the malformed filesystem: SYS_openat (open a file), SYS_ftruncate (truncate the file), or SYS_pwrite64 (write to the file at an offset).
4. Achieve DoS: The exfat_find() function enters an infinite loop due to the unchecked negative valid_size, causing the kernel to hang and the system to become unresponsive.

• Logs: Kernel logs (dmesg, /var/log/kern.log) may show stalled or hung task warnings (e.g., INFO: task <name>:<pid> blocked for more than 120 seconds) related to exFAT filesystem operations.
• Process Behavior: System calls openat, ftruncate, or pwrite64 on an exFAT-mounted path appearing stuck or unresponsive in process listings (ps aux, top) with state D (uninterruptible sleep).
• File System: Presence of an externally supplied or unexpected exFAT filesystem image mounted on the system, particularly from removable media or network shares.
• System: Complete system unresponsiveness or inability to SSH/log in following exFAT filesystem activity by a low-privileged user.

Patches have been merged into the Linux kernel stable branches: versions 6.12.59, 6.17.9, and 6.18 include the fix (ENISA EUVD). Microsoft has also released a patch for the Azure Linux 3 kernel (azl3_kernel ≥ 6.6.117.1-1) (Microsoft MSRC). As a workaround where patching is not immediately possible, restrict local user access to mount exFAT filesystems (e.g., via udisks policies or removing the exfat kernel module with modprobe -r exfat), and avoid auto-mounting untrusted removable media. Prioritize patching on systems where untrusted users have local access or where removable media auto-mount is enabled.

Red Hat published a CVE advisory shortly after disclosure, and Microsoft addressed the vulnerability in its December 2025 Patch Tuesday update cycle for Azure Linux (Microsoft MSRC, Red Hat CVE). Rapid7 noted the vulnerability in its December 2025 Patch Tuesday analysis (Rapid7 Blog). No significant social media controversy or notable researcher commentary beyond standard vulnerability tracking has been observed.