7.8

CVE-2025-38615: fs/ntfs3: cancle set bad inode after removing name fails

Modified
AliasesUBUNTU-CVE-2025-38615DEBIAN-CVE-2025-38615
Published 19-08-2025Last modified 30-10-2026

Vulnerability summary

CVE-2025-38615 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.2% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.18%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 24 · Related 22
MGASA-2025-0234MGASA-2025-0235USN-7879-1USN-7879-2USN-7879-3USN-7879-4

Timeline

  1. 19-08-2025
    PublishedVulnerability first disclosed.
  2. 30-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: cancle set bad inode after removing name fails The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted. The underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier". In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call make_bad_inode() on it just for shits and giggles".

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu136 products
  • linuxAll versions (No fix recorded) | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 78ab59fee07f22464f32eafebab2bd97ba94ff2d, < 47856e10f8d5e066aa26b1f9c02d933fe0620399 | ≥ 78ab59fee07f22464f32eafebab2bd97ba94ff2d, < b35a50d639ca5259466ef5fea85529bb4fb17d5b | ≥ 78ab59fee07f22464f32eafebab2bd97ba94ff2d, < 3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc | ≥ 78ab59fee07f22464f32eafebab2bd97ba94ff2d, < 358d4f821c03add421a4c49290538a705852ccf1 | ≥ 78ab59fee07f22464f32eafebab2bd97ba94ff2d, < a285395020780adac1ffbc844069c3d700bf007a | ≥ 78ab59fee07f22464f32eafebab2bd97ba94ff2d, < d99208b91933fd2a58ed9ed321af07dacd06ddc3 | 5.15
  • linux_kernel≥ 5.15, < 6.6.102 | ≥ 6.7, < 6.12.42 | ≥ 6.13, < 6.15.10 | ≥ 6.16, < 6.16.1
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.43-1 | < 6.16.3-1

3 vendors · 139 products

References

32 links
Show all 32 references