LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71289: fs/ntfs3: handle attr_set_size() errors when truncating files

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the NTFS3 filesystem driver. When a file is truncated and an internal resize operation fails, the error may be ignored, leaving the file’s inode inconsistent. Business impact is unclear from the sources, but systems processing NTFS volumes or disk images should track vendor kernel updates.

Executive priority

Treat this as a kernel maintenance and exposure-reduction item, not a confirmed emergency. Prioritize patching where NTFS media or disk images cross trust boundaries. Severity remains unknown because the public record lacks CVSS, exploit evidence, and clear impact detail.

Technical view

CVE-2025-71289 is a Linux kernel fs/ntfs3 flaw in truncation handling. The described fix makes truncation account for attr_set_size() failures instead of silently ignoring them. The provided record lists stable kernel commit references, but gives no CVSS, CWE, proof-of-exploit, or distribution-specific backport status.

Likely exposure

Exposure is likely limited to Linux systems running affected kernels where the NTFS3 filesystem is present or used. Higher-relevance environments include hosts mounting NTFS removable media, shared storage, forensic images, or VM disk images. The source data does not establish remote exposure or identify affected Linux distributions.

Exploitation context

The bundle states KEV is false and provides no cited evidence of active exploitation or public exploit details. The likely trigger context involves NTFS3 file truncation on affected kernels, but the sources do not describe attacker prerequisites, reliability, or impact beyond inode inconsistency.

Researcher notes

The affected-version data in the bundle is incomplete and hard to interpret, including commit hashes and broad version markers. Analysis should focus on whether downstream kernels include the stable fixes for fs/ntfs3 attr_set_size() error handling. Do not infer exploitability beyond the stated inode inconsistency.

Mitigation direction

  • Apply Linux kernel or distribution updates containing the referenced stable fixes.
  • Prioritize systems that mount NTFS volumes or process untrusted disk images.
  • If no update is available, follow vendor guidance for temporary controls.
  • Reduce exposure to untrusted NTFS media until patched.
  • Track distro advisories for backport status and affected package versions.

Validation and detection

  • Inventory Linux kernel versions and distributions across exposed systems.
  • Confirm whether NTFS3 support is enabled or used in production workflows.
  • Check vendor changelogs for the referenced fs/ntfs3 truncation fix.
  • Verify patched kernels include the relevant stable commits or backports.
  • Review operational logs for NTFS mount activity on sensitive systems.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71289 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4342306f0f0d5ff4315a204d315c1b51b914fca5, 4342306f0f0d5ff4315a204d315c1b51b914fca5, 4342306f0f0d5ff4315a204d315c1b51b914fca5, 4342306f0f0d5ff4315a204d315c1b51b914fca5unaffected
LinuxLinux5.15, 0, 6.12.92, 6.18.34, 6.19.6, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.