Executive brief
A vulnerability exists in the Linux kernel's NTFS3 file system driver, which is used to read and write Windows-formatted drives. A local user could potentially trigger a system crash (denial of service) due to improper handling of internal data structures when processing certain file system operations. This could lead to unexpected downtime or loss of unsaved data on affected systems.
Technical details
A NULL pointer dereference vulnerability exists in the fs/ntfs3/index.c component of the Linux kernel. The function hdr_first_de() can return a NULL pointer when accessing NTFS directory entries, but the indx_get_entry_to_replace() function failed to validate this return value before use. A local attacker with basic user privileges could exploit this flaw to trigger a kernel panic, resulting in a denial of service. The issue has been resolved by implementing proper error handling that returns -EINVAL if a NULL pointer is encountered. Fixes are available in various stable kernel branches including 5.15.y, 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux Kernel 5.15 to 5.15.186, 5.16 to 6.1.142, 6.2 to 6.6.94, 6.7 to 6.12.34, 6.13 to 6.15.3
Timeline
- 2025-07-03: advisory: Initial NVD publication
- 2025-03-18: patched: Initial patch authored by Andrey Vatoropin
References
- https://git.kernel.org/stable/c/2d5879f64554181b89f44d4817b9ea86e8e913e1
- https://git.kernel.org/stable/c/4ecd0cde89feee26525ccdf1af0c1ae156ca010b
- https://git.kernel.org/stable/c/5390b3d4c6d41d05bb9149d094d504cbc9ea85bf
- https://git.kernel.org/stable/c/701340a25b1ad210e6b8192195be21fd3fcc22c7
- https://git.kernel.org/stable/c/83cd0aa74793384dbdffc140500b200e9776a302
- https://git.kernel.org/stable/c/af5cab0e5b6f8edb0be51a9f47f3f620e0b4fd70
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html