CVE-2025-71267

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71267
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute indicates a zero data size while the driver allocates memory for it. When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set to zero, it still allocates memory because of al_aligned(0). This creates an inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute list exists and enumerates only the primary MFT record. When it finds ATTR_LIST, the code reloads it and restarts the enumeration, repeating indefinitely. The mount operation never completes, hanging the kernel thread. This patch adds validation to ensure that data_size is non-zero before memory allocation. When a zero-sized ATTR_LIST is detected, the function returns -EINVAL, preventing a DoS vulnerability.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/06909b2549d631a47fcda249d34be26f7ca1711d Patch
https://git.kernel.org/stable/c/7ef219656febf5ae06ae56b1fce47ebd05f92b68 Patch
https://git.kernel.org/stable/c/8d8c70b57dbeda3eb165c0940b97e85373ca9354 Patch
https://git.kernel.org/stable/c/9267d99fade76d44d4a133599524031fe684156e Patch
https://git.kernel.org/stable/c/976e6a7c51fabf150478decbe8ef5d9a26039b7c Patch
https://git.kernel.org/stable/c/9779a6eaaabdf47aa57910d352b398ad742e6a5f Patch
https://git.kernel.org/stable/c/fd508939dbca5eceefb2d0c2564beb15469572f2 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 May 2026, 18:28

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-835
References () https://git.kernel.org/stable/c/06909b2549d631a47fcda249d34be26f7ca1711d - () https://git.kernel.org/stable/c/06909b2549d631a47fcda249d34be26f7ca1711d - Patch
References () https://git.kernel.org/stable/c/7ef219656febf5ae06ae56b1fce47ebd05f92b68 - () https://git.kernel.org/stable/c/7ef219656febf5ae06ae56b1fce47ebd05f92b68 - Patch
References () https://git.kernel.org/stable/c/8d8c70b57dbeda3eb165c0940b97e85373ca9354 - () https://git.kernel.org/stable/c/8d8c70b57dbeda3eb165c0940b97e85373ca9354 - Patch
References () https://git.kernel.org/stable/c/9267d99fade76d44d4a133599524031fe684156e - () https://git.kernel.org/stable/c/9267d99fade76d44d4a133599524031fe684156e - Patch
References () https://git.kernel.org/stable/c/976e6a7c51fabf150478decbe8ef5d9a26039b7c - () https://git.kernel.org/stable/c/976e6a7c51fabf150478decbe8ef5d9a26039b7c - Patch
References () https://git.kernel.org/stable/c/9779a6eaaabdf47aa57910d352b398ad742e6a5f - () https://git.kernel.org/stable/c/9779a6eaaabdf47aa57910d352b398ad742e6a5f - Patch
References () https://git.kernel.org/stable/c/fd508939dbca5eceefb2d0c2564beb15469572f2 - () https://git.kernel.org/stable/c/fd508939dbca5eceefb2d0c2564beb15469572f2 - Patch
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: fs: ntfs3: corrige bucle infinito provocado por ATTR_LIST de tamaño cero Se encontró un error de bucle infinito en el sistema de archivos ntfs3 que puede llevar a una condición de Denegación de Servicio (DoS). Una imagen NTFS malformada puede causar un bucle infinito cuando un atributo ATTR_LIST indica un tamaño de datos cero mientras el controlador asigna memoria para ello. Cuando ntfs_load_attr_list() procesa un ATTR_LIST residente con data_size establecido en cero, todavía asigna memoria debido a al_aligned(0). Esto crea un estado inconsistente donde ni->attr_list.size es cero, pero ni->attr_list.le no es nulo. Esto hace que ni_enum_attr_ex asuma incorrectamente que no existe ninguna lista de atributos y enumere solo el registro MFT primario. Cuando encuentra ATTR_LIST, el código lo recarga y reinicia la enumeración, repitiéndose indefinidamente. La operación de montaje nunca se completa, colgando el hilo del kernel. Este parche añade validación para asegurar que data_size no sea cero antes de la asignación de memoria. Cuando se detecta un ATTR_LIST de tamaño cero, la función devuelve -EINVAL, previniendo una vulnerabilidad de DoS.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux

18 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-18 11:16

Updated : 2026-05-21 18:28

NVD link : CVE-2025-71267

Mitre link : CVE-2025-71267

CVE.ORG link : CVE-2025-71267

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')