PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71309 Linux CVE debrief

A lock inversion deadlock vulnerability in the Linux kernel's NTFS3 filesystem driver has been resolved. The issue occurred in the compressed folio read path where the inode mutex (ni_lock) and page locks could be acquired in inconsistent order, leading to task hangs. The vulnerability was reported by Syzbot and affects the ni_read_folio_cmpr function (previously ni_readpage_cmpr). The fix restructures locking to acquire page locks before ni_lock, restoring the correct lock ordering consistent with VFS expectations.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

System administrators running Linux systems with NTFS3-mounted volumes, particularly those accessing compressed NTFS files; kernel maintainers and security teams tracking filesystem driver vulnerabilities; organizations using Linux for NTFS data recovery or interoperability scenarios

Technical summary

The NTFS3 filesystem driver in the Linux kernel contained a lock inversion vulnerability in the compressed folio read implementation. The function ni_read_folio_cmpr (formerly ni_readpage_cmpr) could deadlock when one task held the inode mutex (ni_lock) while waiting for page locks, and another task held those page locks while waiting for ni_lock. The vulnerability was triggered by concurrent read operations on compressed NTFS files. The fix restructures the locking to acquire all required page locks for the compressed frame before taking ni_lock, ensuring consistent Page Lock -> ni_lock ordering that matches VFS conventions. This prevents the circular wait condition that caused task hangs.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced commits when available from your Linux distribution
  • Monitor vendor security advisories for kernel package updates addressing this issue
  • Review systems using NTFS3-mounted volumes for unexpected task hangs or I/O stalls
  • Consider temporary mitigation by avoiding concurrent heavy read operations on compressed NTFS files if kernel updates are not immediately available

Evidence notes

The vulnerability description is sourced from the official CVE record and NVD entry. The fix involves kernel-level locking changes in the NTFS3 driver. No CVSS score or severity has been assigned as of the CVE publication date. The vulnerability was discovered through Syzbot automated testing.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-71309 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-71309

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-71309 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71309

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cfe246b318106e1691bd6c9466c739e8559d25c2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e37a75bb866c29da954b51d0dd7670406246d9ee

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.