CVE-2025-71266: fs: ntfs3: check return value of indx_find to avoid infinite loop
In the Linux kernel, the following vulnerability has been resolved:
fs: ntfs3: check return value of indx_find to avoid infinite loop
We found an infinite loop bug in the ntfs3 file system that can lead to a
Denial-of-Service (DoS) condition.
A malformed dentry in the ntfs3 filesystem can cause the kernel to hang
during the lookup operations. By setting the HAS_SUB_NODE flag in an
INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the
VCN pointer, an attacker can cause the indx_find() function to repeatedly
read the same block, allocating 4 KB of memory each time. The kernel lacks
VCN loop detection and depth limits, causing memory exhaustion and an OOM
crash.
This patch adds a return value check for fnd_push() to prevent a memory
exhaustion vulnerability caused by infinite loops. When the index exceeds the
size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find()
function checks this return value and stops processing, preventing further
memory allocation.
Security readout for executives and security teams
Plain-English summary
CVE-2025-71266 is a Linux kernel NTFS3 filesystem denial-of-service issue. A specially malformed NTFS directory entry can make the kernel loop during lookup, repeatedly allocating memory until the system hangs or crashes from out-of-memory conditions.
Executive priority
Treat as a reliability and availability risk, not a confirmed breach indicator. Patch in normal-to-expedited kernel maintenance, with higher urgency for systems handling untrusted storage media or disk images.
Technical view
The ntfs3 indx_find() path failed to stop when directory index traversal exceeded fnd->nodes capacity. Malformed INDEX_ENTRY data with HAS_SUB_NODE and manipulated VCN can cause repeated reads of the same index block. Stable fixes check fnd_push() return values and stop processing on -EINVAL.
Likely exposure
Exposure is most relevant on Linux systems using the in-kernel ntfs3 driver to mount or inspect NTFS filesystems, especially removable media, disk images, forensic workflows, or appliances that process untrusted NTFS content.
Exploitation context
The bundle does not show CISA KEV listing, active exploitation, public exploit code, or network exploitation. The described trigger is crafted filesystem metadata that causes kernel lookup operations to loop and exhaust memory.
Researcher notes
Evidence is limited to the CVE description, Linux stable commit references, and Siemens advisory links. No CVSS, CWE, exploit status, or detailed affected downstream products are provided in the bundle.
Mitigation direction
Update Linux kernels to versions containing the referenced ntfs3 stable fixes.
Prioritize systems that mount or scan untrusted NTFS media or disk images.
Disable automatic mounting of untrusted NTFS filesystems where operationally feasible.
Check Linux distribution and vendor advisories for backported kernel packages.
Review Siemens advisories only for Siemens deployments; bundle details are limited.
Validation and detection
Inventory systems using the in-kernel ntfs3 filesystem driver.
Confirm running kernel package includes one of the referenced stable fixes or vendor backport.
Review removable-media and disk-image processing paths for NTFS exposure.
Check monitoring for kernel hangs, OOM events, or ntfs3-related lookup failures.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-71266 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
1ADP providers
10Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Mar 18, 2026, 10:05 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.