CVE-2025-40287

An infinite loop vulnerability was found in the exFAT filesystem driver in the Linux kernel. The exfat_find() function does not validate if dentry.stream.valid_size is negative. A malformed exFAT filesystem with such entries causes the kernel to hang during file operations like open, truncate, or write.

Mounting a maliciously crafted exFAT filesystem is required. exFAT is commonly used on removable media like SD cards and USB drives, so physical access or control over mounted media could enable this attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.