{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-40068",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-40068",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-10-28T11:48:37.636Z",
    "updatedAt": "2026-08-05T12:07:31.436Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "fs: ntfs3: Fix integer overflow in run_unpack()",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: ntfs3: Fix integer overflow in run_unpack()\n\nThe MFT record relative to the file being opened contains its runlist,\nan array containing information about the file's location on the physical\ndisk. Analysis of all Call Stack paths showed that the values of the\nrunlist array, from which LCNs are calculated, are not validated before\nrun_unpack function.\n\nThe run_unpack function decodes the compressed runlist data format\nfrom MFT attributes (for example, $DATA), converting them into a runs_tree\nstructure, which describes the mapping of virtual clusters (VCN) to\nlogical clusters (LCN). The NTFS3 subsystem also has a shortcut for\ndeleting files from MFT records - in this case, the RUN_DEALLOCATE\ncommand is sent to the run_unpack input, and the function logic\nprovides that all data transferred to the runlist about file or\ndirectory is deleted without creating a runs_tree structure.\n\nSubstituting the runlist in the $DATA attribute of the MFT record for an\narbitrary file can lead either to access to arbitrary data on the disk\nbypassing access checks to them (since the inode access check\noccurs above) or to destruction of arbitrary data on the disk.\n\nAdd overflow check for addition operation.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f6b36cfd25cbadad63447c673743cf771090e756"
            },
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3ac37e100385b59ac821a62118494442238aaac4"
            },
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a86c8b9d03f7101e1750233846fe989df6f0d631"
            },
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "status": "affected",
              "versionType": "git",
              "lessThan": "9378cfe228c2c679564a4116bcb28c8e89dff989"
            },
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "status": "affected",
              "versionType": "git",
              "lessThan": "5aa5799d162ad1b8e8b699d48b6218143c695a78"
            },
            {
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "status": "affected",
              "versionType": "git",
              "lessThan": "736fc7bf5f68f6b74a0925b7e072c571838657d2"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.15",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.15"
            },
            {
              "version": "5.15.195",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.156",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.112",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.53",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.17.3",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "version": "6.18",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}