CVE-2025-71267: Linux Kernel NTFS3 DoS Vulnerability

CVE-2025-71267 Overview

CVE-2025-71267 is a Denial-of-Service vulnerability in the Linux kernel's NTFS3 file system driver. The vulnerability is triggered when processing a malformed NTFS image containing a zero-sized ATTR_LIST attribute. When the ntfs_load_attr_list() function processes a resident ATTR_LIST with data_size set to zero, it creates an inconsistent state that leads to an infinite loop, causing the kernel thread to hang indefinitely during mount operations.

Critical Impact

A maliciously crafted NTFS file system image can cause the Linux kernel to enter an infinite loop, resulting in a Denial-of-Service condition that hangs the kernel thread and prevents system operations from completing.

Affected Products

• Linux kernel with NTFS3 file system support enabled
• Systems that mount NTFS file systems from untrusted sources
• Embedded systems and servers handling external NTFS storage devices

Discovery Timeline

• 2026-03-18 - CVE CVE-2025-71267 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2025-71267

Vulnerability Analysis

The infinite loop vulnerability exists in the NTFS3 file system driver's attribute list handling logic. When processing NTFS file system metadata, the driver encounters ATTR_LIST attributes that describe additional attributes stored in external MFT records. The vulnerable code path fails to validate that the data_size field contains a non-zero value before proceeding with memory allocation.

When ntfs_load_attr_list() processes a resident ATTR_LIST attribute with data_size set to zero, it still allocates memory using al_aligned(0). This creates an inconsistent internal state where ni->attr_list.size is zero, but ni->attr_list.le is non-null. The ni_enum_attr_ex function then incorrectly interprets this state as indicating no attribute list exists and proceeds to enumerate only the primary MFT record.

When the enumeration encounters the ATTR_LIST attribute, the code reloads it and restarts the enumeration process. Because the underlying inconsistent state persists, this cycle repeats indefinitely, causing the mount operation to never complete.

Root Cause

The root cause is a missing input validation check in the ntfs_load_attr_list() function. The function fails to verify that the data_size parameter is non-zero before performing memory allocation. The use of al_aligned(0) returns a non-null pointer even for zero-sized allocations, creating the inconsistent state between ni->attr_list.size (zero) and ni->attr_list.le (non-null) that triggers the infinite loop condition.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious NTFS file system image with a specially constructed ATTR_LIST attribute that has its data_size field set to zero. When a vulnerable Linux system attempts to mount this file system image, the kernel enters an infinite loop, effectively causing a Denial-of-Service condition.

Attack scenarios include:

• Providing a malicious USB drive or external storage device to a target system
• Hosting a malicious NTFS image file for download and subsequent mounting
• Delivering the malicious image through network shares or cloud storage
• Targeting automated systems that mount external file systems without validation

The vulnerability does not require authentication or user interaction beyond triggering the mount operation. The infinite loop occurs within kernel space, making it particularly impactful as it affects system-level operations.

Detection Methods for CVE-2025-71267

Indicators of Compromise

• Kernel threads stuck in an uninterruptible sleep state during NTFS mount operations
• System processes hanging when attempting to access NTFS file systems
• Dmesg or kernel logs showing repeated attribute list processing for the same NTFS volume
• Mount operations that never complete and cannot be interrupted

Detection Strategies

• Monitor kernel thread states for processes stuck in NTFS3 driver code paths
• Implement file system integrity validation before mounting untrusted NTFS images
• Use kernel tracing tools such as ftrace or bpftrace to detect repeated calls to ni_enum_attr_ex on the same inode
• Configure timeouts for mount operations to detect hanging mount attempts

Monitoring Recommendations

• Enable kernel auditing for file system mount operations
• Deploy endpoint detection solutions that can identify kernel-level anomalies
• Implement watchdog timers for automated mount processes
• Monitor system resource utilization for unexpected CPU usage patterns during mount operations
• Log and alert on failed or timed-out mount attempts for forensic analysis

How to Mitigate CVE-2025-71267

Immediate Actions Required

• Apply the latest Linux kernel patches that include the fix for this vulnerability
• Avoid mounting NTFS file systems from untrusted or unknown sources
• Disable automatic mounting of removable media on systems handling sensitive workloads
• Consider disabling the NTFS3 kernel module if not required for operations
• Implement strict access controls for mount operations on multi-user systems

Patch Information

The Linux kernel development team has released patches across multiple stable kernel branches to address this vulnerability. The fix adds validation to ensure that data_size is non-zero before memory allocation in the ntfs_load_attr_list() function. When a zero-sized ATTR_LIST is detected, the function now returns -EINVAL, preventing the inconsistent state that leads to the infinite loop.

Patch commits are available in the following kernel repositories:

• Kernel Commit 06909b2
• Kernel Commit 7ef2196
• Kernel Commit 8d8c70b
• Kernel Commit 9267d99
• Kernel Commit 976e6a7
• Kernel Commit 9779a6e
• Kernel Commit fd50893

Workarounds

• Disable the NTFS3 kernel module using modprobe -r ntfs3 if NTFS support is not required
• Use the older NTFS-3G FUSE driver as an alternative until the kernel can be patched
• Implement mount policies that prevent mounting of external NTFS file systems
• Use containerization or sandboxing to isolate mount operations from critical system components

# Disable NTFS3 kernel module
sudo modprobe -r ntfs3
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf

# Verify module is disabled
lsmod | grep ntfs3