PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71312 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's NTFS3 filesystem driver. In the ntfs_fill_super() function, the fc->fs_private pointer is set to NULL without first freeing the allocated ntfs_mount_options structure. This causes ntfs_fs_free() to skip the cleanup, resulting in a kmemleak-detectable memory leak when mounting NTFS filesystems. The issue was resolved by removing the unnecessary NULL assignment and utilizing the put_mount_options() helper function for proper cleanup.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux system administrators, kernel maintainers, and security teams monitoring for memory exhaustion conditions in systems that mount NTFS filesystems

Technical summary

The NTFS3 filesystem driver in the Linux kernel contains a memory leak in ntfs_fill_super(). The function incorrectly sets fc->fs_private to NULL before the memory it points to (ntfs_mount_options) can be freed. This prevents ntfs_fs_free() from performing cleanup, causing kmemleak-detectable memory leaks during mount operations. The vulnerability is triggered when mounting NTFS filesystems. The fix removes the unnecessary NULL assignment and uses put_mount_options() for proper resource cleanup.

Defensive priority

medium

Recommended defensive actions

  • Apply the kernel patch from the stable tree commits to remove the premature NULL assignment and implement proper cleanup using put_mount_options()
  • Monitor systems for kmemleak reports indicating unreferenced ntfs_mount_options allocations
  • Review custom NTFS mount handling code for similar premature pointer nullification patterns
  • Ensure kernel memory leak detection (kmemleak) is enabled in testing environments to catch similar issues

Evidence notes

The vulnerability is documented in the Linux kernel stable tree commits. The kmemleak report shows unreferenced memory allocation during mount operations. The fix removes the premature NULL assignment to fc->fs_private and replaces open-coded cleanup with put_mount_options().

Sources and references

Verified primary and authoritative sources

  • CVE-2025-71312 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-71312

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-71312 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71312

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dac871d833b09495198dcac81d2ebaa8db11acbc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f7edab0cee03a1cbe0e55a7bcab8d2d8b6b74278

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.