SB2025090515 - Infinite loop in Linux kernel exfat

Description

This security bulletin contains information about 1 security vulnerability.

1) Infinite loop (CVE-ID: CVE-2025-38692)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the exfat_hash_init(), exfat_read_root(), exfat_verify_boot_region(), __exfat_fill_super() and exfat_fill_super() functions in fs/exfat/super.c, within the exfat_check_dir_empty() function in fs/exfat/namei.c, within the exfat_count_num_clusters() function in fs/exfat/fatent.c, within the exfat_find_dir_entry() and exfat_count_dir_entries() functions in fs/exfat/dir.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4c3cda20c4cf1871e27868d08fda06b79bc7d568
• https://git.kernel.org/stable/c/868f23286c1a13162330fa6c614fe350f78e3f82
• https://git.kernel.org/stable/c/99f9a97dce39ad413c39b92c90393bbd6778f3fd
• https://git.kernel.org/stable/c/aa8fe7b7b73d4c9a41bb96cb3fb3092f794ecb33
• https://git.kernel.org/stable/c/e2066ca3ef49a30920d8536fa366b2a183a808ee