High 7.1Published Sep 4, 2025

CVE-2025-38707fs/ntfs3: Add sanity check for file name

Updated under an hour ago (Oct 27, 2026, 6:30 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e before bde58c1539f3ffddffc94d64007de16964e6b8eb; from 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e before f99eb9a641f4ef927d8724f4966dcfd1f0e9f835; from 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e before 3572737a768dadea904ebc4eb34b6ed575bb72d9; 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e builds before 2ac47f738ddfc1957a33be163bc97ee8f78e85a6; from 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e before b51642fc52d1c7243a9361555d5c4b24d7569d7e; 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e builds before 27ee9a42b245efe6529e28b03453291a775cb3e4; from 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e before e841ecb139339602bc1853f5f09daa5d1ea920a2	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.15 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/bde58c1539f3ffddffc94d64007de16964e6b8eb	patch
https://git.kernel.org/stable/c/f99eb9a641f4ef927d8724f4966dcfd1f0e9f835	patch
https://git.kernel.org/stable/c/3572737a768dadea904ebc4eb34b6ed575bb72d9	patch
https://git.kernel.org/stable/c/2ac47f738ddfc1957a33be163bc97ee8f78e85a6	patch
https://git.kernel.org/stable/c/b51642fc52d1c7243a9361555d5c4b24d7569d7e	patch
https://git.kernel.org/stable/c/27ee9a42b245efe6529e28b03453291a775cb3e4	patch
https://git.kernel.org/stable/c/e841ecb139339602bc1853f5f09daa5d1ea920a2	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.