Security tracker / CVE-2025-38615

CVE-2025-38615

fs/ntfs3: cancle set bad inode after removing name fails

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in 78ab59fee07f ("fs/ntfs3: Rework file operations"). Vulnerable
 carnil> versions: 5.15.

Bugs

Status

Branch	Status
upstream	released (6.17-rc1) [d99208b91933fd2a58ed9ed321af07dacd06ddc3]
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	N/A "Fixed before branching point"
6.16-upstream-stable	released (6.16.1) [a285395020780adac1ffbc844069c3d700bf007a]
6.15-upstream-stable	released (6.15.10) [358d4f821c03add421a4c49290538a705852ccf1]
6.12-upstream-stable	released (6.12.42) [3ed2cc6a6e93fbeb8c0cafce1e7fb1f64a331dcc]
6.6-upstream-stable	released (6.6.102) [b35a50d639ca5259466ef5fea85529bb4fb17d5b]
6.1-upstream-stable	needed
5.10-upstream-stable	N/A "Vulnerable code not present"
sid	released (6.16.3-1)
6.12-trixie-security	released (6.12.43-1)
6.1-bookworm-security	needed
5.10-bullseye-security	N/A "Vulnerable code not present"