[SRU][J][PATCH 0/1] CVE-2025-38615

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-38615

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: cancle set bad inode after removing name fails

The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link.
When renaming, the file0's inode is marked as a bad inode because the file name
cannot be deleted.

The underlying bug is that make_bad_inode() is called on a live inode. In some
cases it's "icache lookup finds a normal inode, d_splice_alias() is called to
attach it to dentry, while another thread decides to call make_bad_inode() on
it - that would evict it from icache, but we'd already found it there earlier".
In some it's outright "we have an inode attached to dentry - that's how we got
it in the first place; let's call make_bad_inode() on it just for shits and
giggles".

[ Fix ]

jammy/linux: backported from d99208b91933

The fix stops calling make_bad_inode() on a live inode in the ntfs3 rename
path when a name cannot be removed, so the inode is no longer wrongly evicted
from the icache while it is still attached to a dentry.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

This change only affects the ntfs3 filesystem driver, so any regression would
be limited to systems that mount NTFS volumes with the in-kernel ntfs3 driver,
such as machines reading or writing NTFS-formatted disks and removable media
during rename operations. Systems that never use ntfs3, or that access NTFS
through userspace tools, are not affected.

[ Other Info ]

Kybele flow-v11-25-ga27c0fa6. Reference: f36a9445/v1