LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71267: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute indicates a zero data size while the driver allocates memory for it. When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set to zero, it still allocates memory because of al_aligned(0). This creates an inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute list exists and enumerates only the primary MFT record. When it finds ATTR_LIST, the code reloads it and restarts the enumeration, repeating indefinitely. The mount operation never completes, hanging the kernel thread. This patch adds validation to ensure that data_size is non-zero before memory allocation. When a zero-sized ATTR_LIST is detected, the function returns -EINVAL, preventing a DoS vulnerability.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel denial-of-service issue in the ntfs3 filesystem driver. A malformed NTFS filesystem image with a zero-sized ATTR_LIST can make a mount operation loop indefinitely, hanging the kernel thread. The source bundle does not report code execution, data theft, or active exploitation.

Executive priority

Treat as a targeted availability risk, not a confirmed widespread compromise issue. Prioritize patching on endpoints, appliances, labs, and operational systems that may mount external NTFS media or disk images. Lower priority is reasonable where NTFS mounting is disabled or tightly controlled.

Technical view

ntfs_load_attr_list() accepted a resident ATTR_LIST with data_size zero but still allocated memory via al_aligned(0). That left attr_list.size zero while attr_list.le was non-null, causing attribute enumeration to reload ATTR_LIST and restart indefinitely. The fix rejects zero-sized ATTR_LIST data with -EINVAL.

Likely exposure

Exposure is most likely on Linux systems using the in-kernel ntfs3 driver to mount untrusted NTFS media or disk images. Systems that do not mount NTFS, use fixed kernels, or rely on vendor-backported fixes are likely lower risk. The source bundle lists Linux and Siemens advisories but does not define every downstream product state.

Exploitation context

The provided evidence supports a denial-of-service condition triggered by a malformed NTFS image during mount. KEV is false, and the bundle provides no cited evidence of exploitation in the wild. Practical risk depends on whether attackers can cause a target to mount attacker-controlled NTFS content.

Researcher notes

The root issue is inconsistent attr_list state after zero-sized ATTR_LIST handling. The source bundle names the resolved behavior but provides no CVSS, CWE, exploit report, or complete downstream package mapping. Validation should focus on kernel lineage, ntfs3 usage, and vendor backport status.

Mitigation direction

  • Apply kernel updates containing the referenced ntfs3 ATTR_LIST validation fix.
  • Check Linux distribution advisories for backported fixes matching deployed kernels.
  • Restrict automatic mounting of untrusted NTFS media or images where feasible.
  • Review Siemens advisories for affected Siemens product guidance.
  • Avoid relying on CVE version strings alone for vendor kernels.

Validation and detection

  • Inventory systems that mount NTFS using the Linux ntfs3 driver.
  • Map kernel builds to vendor advisories or the referenced stable commits.
  • Check whether removable media or uploaded disk images are auto-mounted.
  • Confirm Siemens product exposure using the linked Siemens CERT advisories.
  • Record compensating controls where patching is delayed.
Prepared
Confidence
medium
Sources
11

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71267 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbe71b5cba2e6485e8959da7a9f9a44461a1bb074, be71b5cba2e6485e8959da7a9f9a44461a1bb074, be71b5cba2e6485e8959da7a9f9a44461a1bb074, be71b5cba2e6485e8959da7a9f9a44461a1bb074, be71b5cba2e6485e8959da7a9f9a44461a1bb074, be71b5cba2e6485e8959da7a9f9a44461a1bb074, be71b5cba2e6485e8959da7a9f9a44461a1bb074unaffected
LinuxLinux5.15, 0, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.