An out-of-bounds memory read and write vulnerability in the Linux kernel exFAT filesystem driver allows local authenticated attackers to achieve high impact across confidentiality, integrity, and availability.

This vulnerability involves an improper bounds check within the exfat_find_dir_entry function, where crafted directory name entries cause internal pointers to advance past allocated buffers, requiring low local privileges and no user interaction.

A successful exploit of this vulnerability can lead to complete system compromise, kernel crashes, or unauthorized manipulation of sensitive data. Because the flaw permits out-of-bounds reads and writes within kernel memory, local users with access to mount or interact with exFAT filesystems could escalate privileges or cause Denial of Service conditions. The assigned CVSS score of 7.8 places this issue in the high severity category, reflecting the severe consequences of kernel-level memory corruption.

Immediate Action: Update the Linux kernel to the appropriate patched versions, such as 5.10.261, 5.15.212, 6.1.178, 6.6.145, or apply the latest vendor-supplied mainline patches.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unusual filesystem activity associated with exFAT storage media.

Compensating Controls: Restrict local user access and disallow the mounting of untrusted exFAT filesystems on sensitive systems until patches are applied.

Public Exploit Available: False

Security teams must prioritize updating vulnerable Linux kernel installations to the latest stable releases that incorporate the corrected exFAT filesystem bounds checking logic. Given the high severity and potential for kernel memory corruption, applying the official patches immediately is vital to preventing local privilege escalation and system instability.