CVE-2025-38615

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: cancle set bad inode after removing name fails

The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted.

The underlying bug is that makebadinode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, dsplicealias() is called to attach it to dentry, while another thread decides to call makebadinode() on it - that would evict it from icache, but we'd already found it there earlier". In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call makebadinode() on it just for shits and giggles".