Cloudanix VulnDB

CVE-2025-68365

Medium · 5.5

CVSS

5.5

EPSS

0.4%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of NTFS file systems could let uninitialized memory cause crashes when certain disk operations occur, requiring an update to prevent instability.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Uninitialized kernel memory allocated via __getname() (kmem_cache_alloc) is passed to ntfs_read_hdr and bcmp without zeroing, allowing use of arbitrary stack or heap values that can trigger crashes or undefined behavior in the NTFS3 driver.

Why it matters to the business

Systems mounting NTFS volumes may experience unexpected kernel panics or degraded stability, increasing downtime and operational risk for organizations relying on Linux kernels with the ntfs3 driver.

How an attack unfolds

A local attacker with the ability to trigger NTFS operations crafts or supplies a volume that causes the kernel to allocate a name buffer, read its uninitialized contents into ntfs_read_hdr, and perform comparisons in bcmp, leading to unpredictable control flow or denial of service.

How to fix it

Update the Linux kernel to commit bdf38063fd15f2fc7361dc0b5d3c259741eab835 or later, which replaces kmem_cache_alloc with kmem_cache_zalloc in the affected ntfs3 code path. Rebuild and reboot systems with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit bdf38063fd15f2fc7361dc0b5d3c259741eab835 or check that __getname() callers in fs/ntfs3 use kmem_cache_zalloc; confirm via kernel version strings or source inspection.

Typical attack path

  1. Obtain local access or execute code on a Linux system using the ntfs3 driver
  2. Mount or access an NTFS volume that exercises ntfs_read_hdr paths
  3. Trigger allocation via __getname() without subsequent zeroing
  4. Observe kernel crash or undefined behavior from use of uninitialized values

How to detect it

Review kernel logs for oops traces containing ntfs_read_hdr or bcmp; search dmesg and syslog for KMSAN or uninit-value reports involving __getname or ntfs3; no remote network indicators exist.

What your security team should do

  • Prioritize patching production systems that mount NTFS volumes within the next maintenance window
  • Monitor for kernel oops or panic reports referencing ntfs_read_hdr or bcmp
  • Apply the fix to all distributions shipping the vulnerable ntfs3 driver

The record

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize allocated memory before use KMSAN reports: Multiple uninitialized values detected: - KMSAN: uninit-value in ntfs_read_hdr (3) - KMSAN: uninit-value in bcmp (3) Memory is allocated by __getname(), which is a wrapper for kmem_cache_alloc(). This memory is used before being properly cleared. Change kmem_cache_alloc() to kmem_cache_zalloc() to properly allocate and clear memory before use.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.15.0 5.15.199
Linux Kernel 5.15.0 6.18.2
openSUSE:Tumbleweed kernel-source 0 6.18.5-1.1
openSUSE:Tumbleweed kernel-source-longterm 0 6.18.16-1.1

Related vulnerabilities