PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45864 Linux CVE debrief

A vulnerability in the Linux kernel's NTFS3 filesystem driver could allow an attacker to trigger an infinite loop, leading to a denial of service (system hang). The issue occurs when processing valid values within a specific range; if the retrieved valid value remains unchanged, the loop never terminates. This was reported by syzbot, which observed a task blocked for over 143 seconds. The fix adds a check within the loop to detect when the valid value does not progress and returns -EINVAL to prevent the hang. The vulnerability affects the ntfs_file_write_iter function in fs/ntfs3/file.c.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

System administrators running Linux systems with NTFS3 filesystem support enabled; security teams monitoring for denial-of-service conditions; organizations using NTFS-formatted storage on Linux infrastructure

Technical summary

The NTFS3 filesystem driver in the Linux kernel contains a logic error in fs/ntfs3/file.c where the ntfs_file_write_iter function can enter an infinite loop. When iterating through valid values in the range [valid : pos), if the next valid value retrieved is identical to the current value, the loop condition never progresses toward termination. The vulnerability was discovered through syzbot fuzzing, which triggered a 143+ second task block. The fix introduces a check within the loop body to detect stagnant valid values and returns -EINVAL to force loop termination. Seven stable kernel commits are referenced, indicating backports to multiple supported kernel versions.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable tree commits when available from your Linux distribution
  • Monitor vendor security advisories for patched kernel packages
  • If NTFS3 filesystem support is not required, consider disabling the ntfs3 module as a temporary mitigation
  • Review systems for unexpected hangs or high CPU usage in ntfs3-related operations

Evidence notes

The CVE description confirms the vulnerability is in fs/ntfs3 and involves an infinite loop when processing valid values. The syzbot report shows a task blocked for 143+ seconds with a call trace through ntfs_file_write_iter. Seven kernel.org stable tree commits are provided as references, indicating fixes across multiple kernel versions.

Official resources

2026-05-27