Cloudanix VulnDB

CVE-2025-38167

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Jul 3, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel reads certain file system data can let someone with access to the computer crash the whole system by feeding it a specially made drive image.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing NULL check after hdr_first_de() call in ntfs3 allows dereference of a NULL NTFS_DE pointer, resulting in kernel memory corruption or panic.

Why it matters to the business

Local users or processes mounting crafted NTFS volumes can trigger system crashes, leading to denial of service on Linux systems that use the ntfs3 driver; widespread kernel deployments increase exposure surface.

How an attack unfolds

An attacker with local access creates a malicious NTFS image that causes hdr_first_de() to return NULL at the vulnerable call site; when the image is mounted or accessed, the kernel dereferences the NULL pointer and crashes.

How to fix it

Update the Linux kernel to a version containing commit 5390b3d4c6d41d05bb9149d094d504cbc9ea85bf or later; rebuild and deploy the fixed kernel across all affected systems; avoid mounting untrusted NTFS volumes until patched.

How to confirm the fix worked

Verify kernel source contains the error-handling patch around hdr_first_de(); confirm the commit hash 5390b3d4c6d41d05bb9149d094d504cbc9ea85bf is present in the running kernel build; test mounting of previously crashing NTFS images without panic.

Typical attack path

  1. Obtain local user or process execution on target Linux system
  2. Craft NTFS filesystem image designed to trigger NULL return from hdr_first_de()
  3. Mount or open the malicious image using ntfs3 driver
  4. Trigger kernel path that reaches the unchecked return value
  5. Cause NULL pointer dereference resulting in panic or corruption

How to detect it

Search kernel logs for ntfs3-related oops, NULL pointer dereference, or panic messages near NTFS_DE handling; inspect audit logs for unexpected mount attempts of NTFS volumes by non-administrative users.

What your security team should do

  • Prioritize kernel upgrade to the fixed commit on all production systems within standard change windows
  • Restrict unprivileged mounting of external NTFS volumes until patches are applied
  • Monitor for kernel oops or panic events related to ntfs3 after applying updates
  • Review EPSS trend and re-evaluate if new exploit code appears

The record

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle hdr_first_de() return value The hdr_first_de() function returns a pointer to a struct NTFS_DE. This pointer may be NULL. To handle the NULL error effectively, it is important to implement an error handler. This will help manage potential errors consistently. Additionally, error handling for the return value already exists at other points where this function is called. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 linux 0 No fix
Debian:13 linux 0 No fix
Debian:14 linux 0 6.12.35-1
Linux Kernel 5.15.0 5.15.186
Mageia:9 kernel 0 6.6.101-1.mga9
Mageia:9 kernel-linus 0 6.6.101-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.10-7.mga9
Mageia:9 kmod-xtables-addons 0 3.24-83.mga9
Mageia:9 wireless-regdb 0 20250710-1.mga9

Related vulnerabilities