Executive brief
A vulnerability in the Linux kernel's NTFS3 file system driver could allow an attacker to cause a system crash. The issue occurs when the system attempts to modify certain internal NTFS metadata files that are incorrectly handled as regular files. This can lead to an operational failure (denial of service) of the affected server or workstation.
Technical details
A vulnerability exists in the ntfs3 file system driver within the Linux kernel due to an uninitialized 'run_lock' read-write semaphore. When the inode mode of the $Extend system file is set to a regular file (S_IFREG), subsequent calls to the truncate system call trigger the do_truncate() routine. Because the run_lock was not initialized during the loading of $Extend, the kernel attempts to acquire an uninitialized lock, resulting in a kernel panic or 'non-static key' error. This issue was introduced by a previous change that began treating $Extend records as regular files without ensuring all necessary synchronization primitives were initialized. Patches have been released across multiple stable kernel branches to initialize the rwsem in fs/ntfs3/inode.c.
Affected products
- Linux Linux Kernel 5.15.197 to 5.15.198, 6.1.159 to 6.1.160, 6.6.117 to 6.6.120, 6.12.58 to 6.12.63, 6.17.8 to 6.17.13, 6.18
Timeline
- 2025-12-24: advisory: CVE published
- 2025-12-18: patched: Fix committed to stable branches
References
- https://git.kernel.org/stable/c/19164d8228317f3f1fe2662a9ba587cfe3b2d29e
- https://git.kernel.org/stable/c/433d1f7c628c3cbdd7efce064d6c7acd072cf6c4
- https://git.kernel.org/stable/c/6e17555728bc469d484c59db4a0abc65c19bc315
- https://git.kernel.org/stable/c/79c8a77b1782e2ace96d063be3c41ba540d1e20a
- https://git.kernel.org/stable/c/907bf69c6b6ce5d038eec7a599d67b45b62624bc
- https://git.kernel.org/stable/c/ab5e8ebeee1caa4fcf8be7d8d62c0a7165469076
- https://git.kernel.org/stable/c/be99c62ac7e7af514e4b13f83c891a3cccefaa48