CVE-2025-68369

What it actually does

Uninitialized run_lock on the $Extend inode allows do_truncate() to acquire a non-static key, triggering lockdep errors and potential kernel instability during setattr or truncate on NTFS3.

Why it matters to the business

Linux systems mounting NTFS volumes may experience kernel warnings, reduced stability, or crashes when file operations touch the $Extend metadata inode, increasing operational risk until kernels are updated.

How an attack unfolds

An attacker with local access crafts file operations that cause the kernel to treat $Extend as a regular file and invoke truncate, entering ntfs_set_size without the run_lock having been initialized.

How to fix it

Upgrade Linux kernel to 5.15.198 or later; apply commit 79c8a77b1782e2ace96d063be3c41ba540d1e20a; update Chainguard splunk-otel-collector-fips to 0.120.0-r3 or newer.

How to confirm the fix worked

Verify running kernel version contains the run_lock initialization in ntfs_extend(); confirm absence of syzbot-style lockdep warnings on NTFS3 setattr/truncate paths.

Typical attack path

1. Mount an NTFS volume using the ntfs3 driver
2. Trigger inode mode change or setattr on the $Extend metadata inode
3. Invoke truncate or open-for-write that reaches do_truncate()
4. Acquire the uninitialized run_lock, causing lockdep failure or deadlock

How to detect it

Search kernel logs for "INFO: trying to register non-static key" combined with ntfs_set_size, ntfs_extend, or ntfs_setattr stack traces; inspect for repeated lockdep warnings on NTFS3 volumes.

• INFO: trying to register non-static key
• ntfs_set_size+0x140/0x200
• ntfs_extend+0x1d9/0x970
• ntfs_setattr+0x2e8/0xbe0

What your security team should do

• Prioritize kernel upgrades on all systems exposing NTFS3 mounts
• Monitor for lockdep reports involving ntfs_set_size and ntfs_extend
• Restrict untrusted local access until patches are deployed
• Test NTFS3 workloads after upgrade to confirm lock initialization