PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71311 Linux CVE debrief

A vulnerability in the Linux kernel's NTFS3 filesystem driver allows uninitialized memory to be used during compressed write operations. When new folios (memory pages) are allocated without being marked as up-to-date, and the ni_read_frame() function is skipped because the caller expects the frame to be completely overwritten, reserved folios may remain only partially filled. This leaves portions of memory uninitialized, which can then be accessed by longest_match_std() during compression operations. The issue was detected by KMSAN (Kernel Memory Sanitizer). The vulnerability affects the ntfs_compress_write() code path and could potentially lead to information disclosure or undefined behavior from use of uninitialized values.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux systems with NTFS3 filesystem support, particularly those using NTFS compressed files. System administrators managing multi-boot environments or data recovery operations involving NTFS volumes. Kernel developers and security researchers tracking memory safety issues in filesystem drivers.

Technical summary

CVE-2025-71311 is an uninitialized memory vulnerability in the Linux kernel's NTFS3 filesystem driver, specifically affecting the compressed write code path. The issue occurs in ntfs_compress_write() when new folios are allocated without the uptodate flag set. When ni_read_frame() is skipped due to caller assumptions about complete frame overwrites, reserved folios may contain uninitialized memory. This uninitialized data can then be accessed by longest_match_std() during compression operations, as detected by KMSAN. The vulnerability stems from improper initialization of newly allocated folios before use in the NTFS3 compression implementation.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fix for CVE-2025-71311 when available from your Linux distribution
  • Monitor stable kernel releases for patches addressing this NTFS3 initialization issue
  • Consider disabling NTFS3 compressed file support if not required, as a risk reduction measure until patched
  • Review systems using NTFS3 with compressed files for any anomalous behavior
  • Enable kernel memory sanitizers (KMSAN/KASAN) in test environments to detect similar issues

Evidence notes

The vulnerability description indicates this was detected by KMSAN (Kernel Memory Sanitizer) reporting uninitialized values in longest_match_std() called from ntfs_compress_write(). The root cause is identified as new folios being allocated without being marked uptodate, combined with skipped ni_read_frame() calls when the caller expects complete frame overwrites, leaving reserved folios partially filled with uninitialized memory.

Official resources

2026-05-27