LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71266: fs: ntfs3: check return value of indx_find to avoid infinite loop

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid infinite loop We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed dentry in the ntfs3 filesystem can cause the kernel to hang during the lookup operations. By setting the HAS_SUB_NODE flag in an INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the VCN pointer, an attacker can cause the indx_find() function to repeatedly read the same block, allocating 4 KB of memory each time. The kernel lacks VCN loop detection and depth limits, causing memory exhaustion and an OOM crash. This patch adds a return value check for fnd_push() to prevent a memory exhaustion vulnerability caused by infinite loops. When the index exceeds the size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find() function checks this return value and stops processing, preventing further memory allocation.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-71266 is a Linux kernel NTFS3 filesystem denial-of-service issue. A specially malformed NTFS directory entry can make the kernel loop during lookup, repeatedly allocating memory until the system hangs or crashes from out-of-memory conditions.

Executive priority

Treat as a reliability and availability risk, not a confirmed breach indicator. Patch in normal-to-expedited kernel maintenance, with higher urgency for systems handling untrusted storage media or disk images.

Technical view

The ntfs3 indx_find() path failed to stop when directory index traversal exceeded fnd->nodes capacity. Malformed INDEX_ENTRY data with HAS_SUB_NODE and manipulated VCN can cause repeated reads of the same index block. Stable fixes check fnd_push() return values and stop processing on -EINVAL.

Likely exposure

Exposure is most relevant on Linux systems using the in-kernel ntfs3 driver to mount or inspect NTFS filesystems, especially removable media, disk images, forensic workflows, or appliances that process untrusted NTFS content.

Exploitation context

The bundle does not show CISA KEV listing, active exploitation, public exploit code, or network exploitation. The described trigger is crafted filesystem metadata that causes kernel lookup operations to loop and exhaust memory.

Researcher notes

Evidence is limited to the CVE description, Linux stable commit references, and Siemens advisory links. No CVSS, CWE, exploit status, or detailed affected downstream products are provided in the bundle.

Mitigation direction

  • Update Linux kernels to versions containing the referenced ntfs3 stable fixes.
  • Prioritize systems that mount or scan untrusted NTFS media or disk images.
  • Disable automatic mounting of untrusted NTFS filesystems where operationally feasible.
  • Check Linux distribution and vendor advisories for backported kernel packages.
  • Review Siemens advisories only for Siemens deployments; bundle details are limited.

Validation and detection

  • Inventory systems using the in-kernel ntfs3 filesystem driver.
  • Confirm running kernel package includes one of the referenced stable fixes or vendor backport.
  • Review removable-media and disk-image processing paths for NTFS exposure.
  • Check monitoring for kernel hangs, OOM events, or ntfs3-related lookup failures.
Prepared
Confidence
medium
Sources
11

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71266 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux82cae269cfa953032fbb8980a7d554d60fb00b17, 82cae269cfa953032fbb8980a7d554d60fb00b17, 82cae269cfa953032fbb8980a7d554d60fb00b17, 82cae269cfa953032fbb8980a7d554d60fb00b17, 82cae269cfa953032fbb8980a7d554d60fb00b17, 82cae269cfa953032fbb8980a7d554d60fb00b17, 82cae269cfa953032fbb8980a7d554d60fb00b17unaffected
LinuxLinux5.15, 0, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.