Executive brief
A vulnerability in the Linux kernel's NTFS3 file system driver can cause the system to hang or become unresponsive. This occurs when the system enters an infinite loop while processing certain file write operations. An attacker with local access could exploit this to cause a denial-of-service, impacting system availability and business operations.
Technical details
A vulnerability exists in the fs/ntfs3/file.c component of the Linux kernel. The issue is caused by a lack of validation for the 'valid' value during compressed write operations in the ntfs_compress_write function. When processing a range where the next valid value retrieved is identical to the current value, the kernel enters an infinite loop. This results in a task hang, as reported by syzbot, where the process blocks indefinitely while holding locks. The fix introduces a check to terminate the loop and return -EINVAL if the value remains unchanged. This is reachable by local users performing specific file operations on NTFS partitions.
Affected products
- Linux Linux Kernel All versions including and prior to 6.13 (fixed in 6.14 and backported)
Timeline
- 2025-12-28: other: Patch authored by Edward Adam Davis
- 2026-01-15: patched: Committed to mainline kernel
- 2026-05-27: disclosed: CVE published and NVD record created
References
- https://git.kernel.org/stable/c/27b75ca4e51e3e4554dc85dbf1a0246c66106fd3
- https://git.kernel.org/stable/c/4bf3bafb8e0635ed93e3cd4156dcbcc0fb960cb4
- https://git.kernel.org/stable/c/50c822fcb36768f1fb356f05b02a2248ef81936d
- https://git.kernel.org/stable/c/6d93239b4fc479f7c0a412dd196ec0ca2672d14a
- https://git.kernel.org/stable/c/71c8b966ec56e13c02388c1312910588bb49be7a
- https://git.kernel.org/stable/c/a47a2bb9aa6455d5cee1045814a60c749309c92b
- https://git.kernel.org/stable/c/b97e371e5d1c13d722335d46eb8bc1a22b272a0e