LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39734: Revert "fs/ntfs3: Replace inode_trylock with inode_lock"

In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode_trylock with inode_lock" This reverts commit 69505fe98f198ee813898cbcaf6770949636430b. Initially, conditional lock acquisition was removed to fix an xfstest bug that was observed during internal testing. The deadlock reported by syzbot is resolved by reintroducing conditional acquisition. The xfstest bug no longer occurs on kernel version 6.16-rc1 during internal testing. I assume that changes in other modules may have contributed to this.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel NTFS3 filesystem locking flaw that was fixed by reverting a prior change. The reported failure mode is a deadlock, which can affect system availability when NTFS3 code paths are reached. The sources do not provide CVSS, confirmed exploitation, or a detailed impact statement beyond the deadlock.

Executive priority

Handle through normal kernel patch governance unless NTFS media handling is business-critical. Escalate if affected systems routinely mount untrusted NTFS volumes or support operational workflows where a kernel deadlock would cause material downtime.

Technical view

The fix reverts commit 69505fe98f198ee813898cbcaf6770949636430b, restoring conditional inode lock acquisition in fs/ntfs3. The CVE text says syzbot reported a deadlock and internal testing no longer reproduced the earlier xfstest issue on 6.16-rc1. Stable kernel commits and a Debian LTS advisory are listed as references.

Likely exposure

Exposure is most relevant to Linux systems running affected kernels where NTFS3 is enabled or used to mount/process NTFS filesystems. The source bundle lists Linux kernel versions and stable commits, but version semantics are incomplete here; confirm against distribution advisories.

Exploitation context

No active exploitation is stated in the provided sources, and the CVE is not marked KEV. Evidence points to a syzbot-reported kernel deadlock rather than a published real-world attack path. Treat exploitation status as unconfirmed.

Researcher notes

The public description is sparse: no CVSS, CWE, exploitability analysis, or complete product matrix is included. The strongest technical signal is the revert restoring conditional locking to address a syzbot deadlock. Validate exact affected and fixed ranges from upstream commits and vendor backports.

Mitigation direction

  • Check your Linux distribution advisory for CVE-2025-39734-specific kernel updates.
  • Apply kernel updates containing the referenced stable ntfs3 revert fixes.
  • Prioritize hosts that mount or process NTFS filesystems with ntfs3.
  • Avoid relying on manual backports unless validated by your kernel vendor.
  • Monitor Debian LTS and Linux stable channels for backport status.

Validation and detection

  • Inventory Linux kernel versions across servers, endpoints, appliances, and containers with host kernel dependency.
  • Check whether ntfs3 is enabled, loaded, or used for NTFS mounts.
  • Compare installed kernel builds with distribution fixed packages or referenced stable commits.
  • Review kernel logs for filesystem hangs, blocked tasks, or NTFS3-related deadlocks.
  • Test vendor kernel updates in staging before production rollout.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39734 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe3e3b3eb54feaf6400800812c8d0f95a7213923d, 7a498fc945080bccc25fdc36f1d663798441158b, 53173e3865acb06f3e86c703696510c12fecc612, 69505fe98f198ee813898cbcaf6770949636430b, 69505fe98f198ee813898cbcaf6770949636430b, 69505fe98f198ee813898cbcaf6770949636430b, 69505fe98f198ee813898cbcaf6770949636430b, d5ad80aabd5a76a5de52b7663b1f3223dd01ea38, 5.15.165, 6.1.103, 6.6.44, 6.10.3unaffected
LinuxLinux6.11, 0, 5.15.190, 6.1.148, 6.6.102, 6.12.42, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.