CVE-2025-71267: Linux Kernel NTFS3 DoS Vulnerability

CVE-2025-71267 Overview

CVE-2025-71267 is a Denial-of-Service vulnerability in the Linux kernel's NTFS3 file system driver. The vulnerability is triggered when processing a malformed NTFS image containing a zero-sized ATTR_LIST attribute. When the ntfs_load_attr_list() function processes a resident ATTR_LIST with data_size set to zero, it creates an inconsistent state that leads to an infinite loop, causing the kernel thread to hang indefinitely during mount operations.

Critical Impact
A maliciously crafted NTFS file system image can cause the Linux kernel to enter an infinite loop, resulting in a Denial-of-Service condition that hangs the kernel thread and prevents system operations from completing.

Affected Products

Linux kernel with NTFS3 file system support enabled
Systems that mount NTFS file systems from untrusted sources
Embedded systems and servers handling external NTFS storage devices

Discovery Timeline

2026-03-18 - CVE CVE-2025-71267 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2025-71267

Vulnerability Analysis

The infinite loop vulnerability exists in the NTFS3 file system driver's attribute list handling logic. When processing NTFS file system metadata, the driver encounters ATTR_LIST attributes that describe additional attributes stored in external MFT records. The vulnerable code path fails to validate that the data_size field contains a non-zero value before proceeding with memory allocation.

When ntfs_load_attr_list() processes a resident ATTR_LIST attribute with data_size set to zero, it still allocates memory using al_aligned(0). This creates an inconsistent internal state where ni->attr_list.size is zero, but ni->attr_list.le is non-null. The ni_enum_attr_ex function then incorrectly interprets this state as indicating no attribute list exists and proceeds to enumerate only the primary MFT record.

When the enumeration encounters the ATTR_LIST attribute, the code reloads it and restarts the enumeration process. Because the underlying inconsistent state persists, this cycle repeats indefinitely, causing the mount operation to never complete.

Root Cause

The root cause is a missing input validation check in the ntfs_load_attr_list() function. The function fails to verify that the data_size parameter is non-zero before performing memory allocation. The use of al_aligned(0) returns a non-null pointer even for zero-sized allocations, creating the inconsistent state between ni->attr_list.size (zero) and ni->attr_list.le (non-null) that triggers the infinite loop condition.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious NTFS file system image with a specially constructed ATTR_LIST attribute that has its data_size field set to zero. When a vulnerable Linux system attempts to mount this file system image, the kernel enters an infinite loop, effectively causing a Denial-of-Service condition.

Attack scenarios include:

Providing a malicious USB drive or external storage device to a target system
Hosting a malicious NTFS image file for download and subsequent mounting
Delivering the malicious image through network shares or cloud storage
Targeting automated systems that mount external file systems without validation

The vulnerability does not require authentication or user interaction beyond triggering the mount operation. The infinite loop occurs within kernel space, making it particularly impactful as it affects system-level operations.

Detection Methods for CVE-2025-71267

Indicators of Compromise

Kernel threads stuck in an uninterruptible sleep state during NTFS mount operations
System processes hanging when attempting to access NTFS file systems
Dmesg or kernel logs showing repeated attribute list processing for the same NTFS volume
Mount operations that never complete and cannot be interrupted

Detection Strategies

Monitor kernel thread states for processes stuck in NTFS3 driver code paths
Implement file system integrity validation before mounting untrusted NTFS images
Use kernel tracing tools such as ftrace or bpftrace to detect repeated calls to ni_enum_attr_ex on the same inode
Configure timeouts for mount operations to detect hanging mount attempts

Monitoring Recommendations

Enable kernel auditing for file system mount operations
Deploy endpoint detection solutions that can identify kernel-level anomalies
Implement watchdog timers for automated mount processes
Monitor system resource utilization for unexpected CPU usage patterns during mount operations
Log and alert on failed or timed-out mount attempts for forensic analysis

How to Mitigate CVE-2025-71267

Immediate Actions Required

Apply the latest Linux kernel patches that include the fix for this vulnerability
Avoid mounting NTFS file systems from untrusted or unknown sources
Disable automatic mounting of removable media on systems handling sensitive workloads
Consider disabling the NTFS3 kernel module if not required for operations
Implement strict access controls for mount operations on multi-user systems

Patch Information

The Linux kernel development team has released patches across multiple stable kernel branches to address this vulnerability. The fix adds validation to ensure that data_size is non-zero before memory allocation in the ntfs_load_attr_list() function. When a zero-sized ATTR_LIST is detected, the function now returns -EINVAL, preventing the inconsistent state that leads to the infinite loop.

Patch commits are available in the following kernel repositories:

Workarounds

Disable the NTFS3 kernel module using modprobe -r ntfs3 if NTFS support is not required
Use the older NTFS-3G FUSE driver as an alternative until the kernel can be patched
Implement mount policies that prevent mounting of external NTFS file systems
Use containerization or sandboxing to isolate mount operations from critical system components

bash

# Disable NTFS3 kernel module
sudo modprobe -r ntfs3
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf

# Verify module is disabled
lsmod | grep ntfs3