CVE-2025-68728

What it actually does

The ntfs3 driver fails to mark a buffer obtained from sb_getblk() as uptodate before use in mi_format_new after a failed mi_read, allowing uninitialized kernel memory to be added to an mi record and later accessed, resulting in KMSAN-detected use of uninitialized data.

Why it matters to the business

Kernel memory corruption or information disclosure risk on systems using the ntfs3 NTFS driver; low public exploitability reduces immediate operational urgency but still requires patching to maintain kernel integrity on Linux hosts handling NTFS volumes.

How an attack unfolds

An attacker with local access crafts filesystem operations that trigger the mi_format_new path in ntfs3 after a read failure; the un-uptodate buffer containing uninitialized data is then treated as valid, potentially leaking kernel memory or causing further corruption when the record is loaded.

How to fix it

Update the Linux kernel to a version containing commit afb144bc8e920db43a23e996eb0a6f9bdea84341 or later; for packaged distributions such as Chainguard or Wolfi rebuilds of go-discover, upgrade to 0_git20250320-r0 or newer; disable ntfs3 module if NTFS3 support is unnecessary.

How to confirm the fix worked

Verify the running kernel contains the fix commit, confirm absence of KMSAN reports during NTFS3 operations that previously triggered the path, and test with reproducers from the syzkaller report if available.

Typical attack path

1. Obtain local code execution or shell on a Linux system with ntfs3 enabled
2. Prepare or mount an NTFS volume that exercises the mi_read failure path
3. Trigger mi_format_new via filesystem metadata operations
4. Access or observe the resulting uninitialized memory contents or side effects

How to detect it

Review kernel logs for KMSAN or UBSAN reports mentioning mi_format_new, ntfs_get_bh, or uninitialized memory during NTFS3 activity; examine audit logs for unusual local filesystem operations targeting NTFS volumes.

What your security team should do

• Prioritize kernel updates on systems exposing NTFS3 volumes within standard patch windows
• Audit workloads for ntfs3 usage and restrict module loading via kernel command line or modprobe blacklist where feasible
• Monitor EPSS and KEV status for any future increase in exploit maturity