CVE-2025-40067

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption.

syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT, due to unexpected index state.

Reject such cases by verifying that the bitmap is not empty when index blocks exist.

This vulnerability does not affect Red Hat Enterprise Linux as the vulnerable NTFS3 code is not present in supported Red Hat kernels. In upstream environments, triggering this flaw requires mounting a corrupted or maliciously crafted file system image, limiting exposure to scenarios where untrusted storage media or disk images can be mounted.