CVE-2025-22081

What it actually does

Integer overflow during offset plus sizeof(NTFS_DE) calculation in ntfs3 on 32-bit systems allows wrap-around that can corrupt memory layout.

Why it matters to the business

32-bit Linux systems using the ntfs3 driver face elevated risk of crashes or unintended code execution when handling specially crafted NTFS structures, potentially disrupting operations until kernels are updated.

How an attack unfolds

An attacker supplies an NTFS directory entry whose offset value, when added to the size of the NTFS_DE structure, wraps on 32-bit arithmetic; the kernel then uses the wrapped value for memory operations, enabling corruption or control-flow hijacking.

How to fix it

Upgrade the Linux kernel to commit 0922d86a7a6032cb1694eab0b44b861bd33ba8d5 or later; for affected Red Hat packages apply gimp 2:2.8.22-1.el7_9.1 or newer equivalents that incorporate the corrected driver.

How to confirm the fix worked

Confirm kernel version contains commit 0922d86a7a6032cb1694eab0b44b861bd33ba8d5; recompile or boot test kernels and exercise ntfs3 directory parsing on 32-bit builds to verify size_add protection is active.

Typical attack path

1. Mount attacker-controlled NTFS volume on vulnerable 32-bit kernel
2. Trigger directory enumeration or file open that processes the malicious NTFS_DE entry
3. Trigger integer wrap in off + sizeof calculation
4. Exploit resulting memory corruption for code execution or denial of service

How to detect it

Review kernel logs for ntfs3-related oops or warning messages around NTFS_DE processing; examine auditd or syslog entries for unexpected mounts of external NTFS volumes on 32-bit hosts.

What your security team should do

• Prioritize kernel updates on all 32-bit systems using ntfs3
• Scan for ntfs3 usage in production workloads and schedule phased rollouts
• Monitor EPSS and KEV feeds for any future rise in exploit activity
• Apply vendor patches matching the listed fixed versions without delay