Security readout for executives and security teams
Plain-English summary
Linux’s NTFS3 driver may use partially uninitialized memory while writing compressed NTFS data. This could expose residual kernel memory or slightly alter written data. The issue matters primarily where affected kernels actively use NTFS3 compression; the supplied evidence does not establish widespread exploitation or precise real-world impact.
Executive priority
Prioritize verification and routine expedited patching on systems using NTFS3, especially those handling untrusted NTFS media or data. Broad emergency action is not supported without confirmed NTFS3 exposure or exploitation evidence. Ask infrastructure teams to report affected systems, vendor patch availability, and remediation timing.
Technical view
New folios may be allocated without being marked uptodate. When ntfs_compress_write() expects a frame to be fully overwritten and skips ni_read_frame(), reserved folios can remain partially uninitialized. KMSAN detected the resulting value reaching longest_match_std(). Linux stable commits initialize new folios before use.
Likely exposure
Potential exposure is limited to Linux systems running affected kernel builds and using the NTFS3 filesystem driver for compressed writes. The supplied affected-version data names 6.11, 6.12.75, 6.18.14, 6.19.4, and 7.0, but does not clearly define complete version ranges. Distribution advisories should determine exact package exposure.
Exploitation context
The supplied record is not marked as CISA KEV, and no source provided reports active exploitation or a public exploit. The CVSS 3.1 score is 8.2, emphasizing confidentiality impact, but practical trigger conditions and attacker reachability are not established in the bundle.
Researcher notes
The finding originated from KMSAN during ntfs_compress_write() and concerns incompletely initialized folios reaching longest_match_std(). The supplied CVSS vector indicates network reachability, but the technical description does not explain a remote attack path. No CWE, proof of concept, exploitation telemetry, or complete affected-range semantics are provided.
Mitigation direction
- Apply a vendor kernel update containing the applicable Linux stable fix.
- Consult the operating-system distributor for exact affected and fixed package versions.
- Limit use of NTFS3 compressed writes until remediation if operationally practical.
- Prioritize systems processing untrusted or externally supplied NTFS volumes.
Validation and detection
- Inventory kernel versions and distribution package revisions across Linux systems.
- Identify systems mounting NTFS filesystems through the NTFS3 driver.
- Determine whether affected systems perform compressed NTFS writes.
- Confirm the installed kernel includes the distributor’s backported fix or an applicable referenced commit.
- Monitor vendor advisories for corrected version-range information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-71311 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N3.94.2LinuxVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/dd6c81527d097b3b0bf5a15c2fdc9657d045144cCVE reference, Linux
- https://git.kernel.org/stable/c/5a30cc03bde169ad558695b26da6ea7e55f6194aCVE reference, Linux
- https://git.kernel.org/stable/c/41d79f8e2a36622d148719bf7c18b46ac1264284CVE reference, Linux
- https://git.kernel.org/stable/c/f223ebffa185cc8da934333c5a31ff2d4f992dc9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.