CVE-2025-71311 Linux CVE debrief

Who should care

Organizations running Linux systems with NTFS3 filesystem support, particularly those using NTFS compressed files. System administrators managing multi-boot environments or data recovery operations involving NTFS volumes. Kernel developers and security researchers tracking memory safety issues in filesystem drivers.

Technical summary

CVE-2025-71311 is an uninitialized memory vulnerability in the Linux kernel's NTFS3 filesystem driver, specifically affecting the compressed write code path. The issue occurs in ntfs_compress_write() when new folios are allocated without the uptodate flag set. When ni_read_frame() is skipped due to caller assumptions about complete frame overwrites, reserved folios may contain uninitialized memory. This uninitialized data can then be accessed by longest_match_std() during compression operations, as detected by KMSAN. The vulnerability stems from improper initialization of newly allocated folios before use in the NTFS3 compression implementation.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates containing the fix for CVE-2025-71311 when available from your Linux distribution
• Monitor stable kernel releases for patches addressing this NTFS3 initialization issue
• Consider disabling NTFS3 compressed file support if not required, as a risk reduction measure until patched
• Review systems using NTFS3 with compressed files for any anomalous behavior
• Enable kernel memory sanitizers (KMSAN/KASAN) in test environments to detect similar issues

Evidence notes

The vulnerability description indicates this was detected by KMSAN (Kernel Memory Sanitizer) reporting uninitialized values in longest_match_std() called from ntfs_compress_write(). The root cause is identified as new folios being allocated without being marked uptodate, combined with skipped ni_read_frame() calls when the caller expects complete frame overwrites, leaving reserved folios partially filled with uninitialized memory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.