CVE-2025-71265 Linux CVE debrief

Who should care

Linux kernel maintainers, distro security teams, fleet operators, and administrators who mount or process untrusted NTFS volumes or images should prioritize this issue. Environments that use ntfs3 and may encounter user-supplied or external NTFS media are the most relevant.

Technical summary

The supplied description says a malformed NTFS image can present inconsistent metadata: the attribute header can indicate an empty run list (evcn=-1 with svcn=0), while the caller expects actual data. run_unpack() correctly returns early for the empty-run-list case, but if the surrounding metadata is inconsistent, runs_tree remains uninitialized and attr_load_runs_range() can keep calling run_lookup_entry() without making progress. Because vcn is incremented by zero in that failure path, the loop does not terminate. The patch adds a retry counter and returns -EINVAL after repeated lookup failure, which stops the infinite loop and prevents the DoS condition.

Defensive priority

Medium. This is a local denial-of-service issue in a kernel filesystem path, so it does not indicate direct remote code execution, but it can still hang or degrade systems that process untrusted NTFS content.

Recommended defensive actions

• Upgrade to a Linux kernel version that includes the ntfs3 fix or verify that your distribution has backported it.
• Check whether your fleet is exposed to untrusted NTFS media, disk images, or removable storage and prioritize patching those systems.
• Confirm remediation against the NVD-listed fixed branches and end versions: 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, and 6.19.6.
• Track vendor advisories and kernel stable backports for your specific distro kernel rather than relying only on upstream version numbers.
• If patching must be delayed, reduce exposure to untrusted NTFS content on systems that rely on ntfs3.

Evidence notes

Evidence is drawn from the supplied NVD record and its official references. NVD marks the vulnerability as Analyzed and classifies it with CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, with CWE-835 listed as the primary weakness. NVD also lists affected Linux kernel ranges for 5.15, 5.16, 6.2, 6.7, 6.13, and 6.19 branches, each with an upper bound indicating the fixed release threshold. The supplied description explains the infinite-loop mechanism and the retry-counter mitigation. The official patch references from git.kernel.org are the primary remediation evidence.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.