CVE-2025-38707

What it actually does

Missing length validation on NTFS file names allows names exceeding directory entry size, enabling out-of-bounds memory access in the ntfs3 driver.

Why it matters to the business

Local attackers on affected Linux systems can crash the kernel or gain elevated privileges, disrupting container workloads and requiring urgent patching across MinimOS-based deployments.

How an attack unfolds

An attacker with local access supplies a malicious NTFS filesystem image containing an oversized file name; when mounted or parsed by the vulnerable ntfs3 code, the missing sanity check leads to memory corruption that can be leveraged for privilege escalation, similar to patterns seen in related Linux kernel container escapes.

How to fix it

Upgrade affected packages to the listed fixed versions: istio-1.27 and related MinimOS components to 1.27.0-r1; Linux kernel to commit bde58c1539f3ffddffc94d64007de16964e6b8eb or later stable release containing the ntfs3 sanity check.

How to confirm the fix worked

Verify running kernel contains the ntfs3 file-name length check; confirm package versions match or exceed the fixed releases for istio-1.27 components; test mounting of crafted NTFS images no longer triggers crashes or corruption.

Typical attack path

1. Obtain local access or container escape foothold on target system
2. Prepare malicious NTFS image with file name longer than directory entry
3. Trigger mount or directory traversal operation that invokes ntfs3 parsing
4. Exploit resulting memory corruption for code execution or privilege gain

How to detect it

Review kernel logs and audit trails for ntfs3-related oops or page-fault entries during NTFS mount operations; correlate with container runtime events on MinimOS hosts; search for unexpected privilege changes following directory enumeration.

What your security team should do

• Prioritize kernel and istio package upgrades to the exact fixed versions within the next maintenance window
• Restrict untrusted NTFS mounts and limit local user access on systems using ntfs3
• Monitor for related Linux kernel privilege-escalation activity reported by the listed threat actors